[openpgp] Signing-only primary keys

[Wiktor Kwapisiewicz <[e-mail]>]

Hi folks,

I've got a question about using signing-only primary keys.

In our project we're creating certificates that will be used only for 
signing artifacts (for example packages). They are not meant to issue 
third-party certifications and I thought that, following the principle 
of least privilege, it would be good to drop the Certification flag from 
the primary key altogether and leave only the Signing key flag.

Our initial tests seem to indicate that signing-only-primary-key 
certificates don't cause any problems (tested implementations: gpg, 
rsop, sqop). Inspecting the certificate in GnuPG revealed that it adds 
the "C" flag anyway :)

I didn't see any further tests at https://tests.sequoia-pgp.org/ but 
maybe I overlooked it.

I've browsed https://www.rfc-editor.org/rfc/rfc9580#name-key-flags and 
https://www.rfc-editor.org/rfc/rfc4880#section-5.2.3.21 and the key flag 
0x01 is clearly marked as concerning "other keys" which we don't want in 
this use-case.

Is my reasoning valid that dropping the "C" key flag is okay or is 
anyone aware of practical issues with it?

Thanks for your time!

Kind regards,
Wiktor

P.S. The MR dropping the flag is at 
https://gitlab.archlinux.org/archlinux/signstar/-/merge_requests/206