Is it possible to assign different UIDs to subkeys for the purpose of having multiple identities?

Question

Many people advocate generating new primary keys for each identity they wish to have. For example, creating one primary key and associated subkeys for workplace use, and a completely different primary key and associated subkeys for personal use.

But is it possible to generate one primary key, and create multiple subkeys that can each have their own unique UIDs for whatever purpose you desire? For example, I create two subkeys (one for signing, one for encryption) for work, setting their UID's appropriately, and another two for personal use? Is it even possible for sets of subkeys to be completely distinct from one another when they come from the same parent primary key? Would there be a benefit to this configuration? I've been using GnuPG for a while, and the UID aspect of keys has always confused me.

Answer 1

Consider a single primary key to be equivalent to one identity.

You cannot connect subkeys to user IDs. Both subkeys and user IDs are attached to the primary key, the only connection from user IDs to subkeys is through the primary key.

If you want to select different subkeys for different machines (for example at home and at work), this is easily possible for signing (simply only put one signing subkey on each machine), but again it would not be connected to a specific user ID (but to the primary key).

For encryption, there is no such way, a sender's OpenPGP implementation will usually just choose the newest key (and maybe offer a choice to select a specific key).

Use multiple cross-signed primary keys instead, if you want to separate concerns.