Re: [openpgp] primary key binding signature requirement

["Neal H. Walfield" <[e-mail]>]

On Fri, 02 Dec 2022 23:38:05 +0100,
Aron Wussler wrote:
> > if a subkey binding signature includes the Key Flags subpacket and
> > the certification capability (0x1) or the signing capability (0x2)
> > is set, then the subkey binding signature must also contain a valid
> > primary key binding signature issued by the subkey over the primary
> > key.
> 
> I agree with this.
> 
> As a side note, I don't know whether we should allow subkeys to issue certifications.
> 
> In real life I found poor support for subkeys with certification capability. I found no real way to create such keys (without messing with them manually) and other implementations didn't understand certifications made from that key.
> 
> Maybe we should either forbid that entirely or explicitly support it.

I agree that support for certification-capable subkeys is quite poor.
And, I think that is quite unfortunate.

A certification-capable subkey can be particularly helpful when using
an offline primary key: even though the primary key is offline, it is
still possible to create third-party signatures online.  This is a
major pain point for me.  When I want to certify a certificate, I need
to boot up my offline computer, transfer the certificate, certify it,
and then transfer it back.  Having a certification-capable subkey
would reduce that friction.

I'm also aware of a company that does centralized key management, and
doesn't give users access to their primary key.  This means that users
are not able to directly create third-party certifications.  Instead
they have to use a web portal.  That, of course, integrates horribly
with other tooling.  Certification-capable subkeys would also help
here.

Anyway, I believe this discussion is out of scope for the crypto
refresh.

Neal