GPG: Detaching Public Subkeys - why can't I do it?

Question

I understand the benefits of using subkeys. I also know that, in the case of private keys it is possible to detach the subkeys from the master key, since there are times when a user may prefer not to store the private master key with the private subkeys. (Using gpg, --export-secret-subkeys) Moreover, when you do --export a public key, it appears not to matter whether you use the fingerprint of the master key or that of one of the subkeys.

As far as I can tell, it's not possible to detach public subkeys. Let me be clear: I can't think of any significant reason why one would wish to. The only rationale I can think of is minimalist - you might want to only import the public subkeys because that's all that you intend to use. But I am trying to figure out whether there is a more fundamental reason.

• Is it because the user id details are attached to the master key, and detaching subkeys would allow unidentified keys to float around? (I'm not convinced by this - when you import detached private subkeys, the absent master key still gets a reference [sec# etc.], even when it is absent. So surely the same could be done for public keys.)
• Is it just because there is no good reason for doing so?

If, however, there is some reason public subkeys can't logically be split from the public master key, that would suggest I don't properly understand subkeys.

Answer 1

Detaching Subkeys in Theory...

Detach subkeys does not correspond well with the OpenPGP model of primary keys, subkeys, user IDs, certifications and trust.

Both subkeys and user IDs are bound to the primary key, each individually. Certifications are applied on tuples of primary keys and user IDs, trust directly on primary keys.

You could very well detach a subkey from its primary key and use it (as a primary key), in necessary by fiddling with the bits in the OpenPGP packets. But without the connection with the primary key, it is in fact a completely new key without any certifications and trust (although the key material, the numbers behind it, stay the same).

... and Practice

Be aware that when exporting subkeys using gpg --export-secret-subkeys, a primary key stub is always exported, together with user IDs; because of this, GnuPG will display the "absent master key [...] reference [sec# etc.]" as you called it.

You can easily verify it by running

gpg --export-secret-subkeys [subkey-id]! | gpg --list-packets

for example (for subkey 0xDEADBEEF)

gpg --export-secret-subkeys 0xDEADBEEF! | gpg --list-packets

Make sure to include a ! after the subkey id, otherwise GnuPG will resolve the associated primary key and thus export all available subkeys!

Really Breaking Things Apart

To really separate the subkey, you could use gpgsplit, which dissects an OpenPGP message into its actual subpackets. Working with them requires deeper knowledge of the OpenPGP specifications (RFC 4880), but it makes fiddling with the individual packets (also with hex editors) and recompiling valid OpenPGP messages using cat rather easy.