[openpgp] primary key binding signature requirement

["Neal H. Walfield" <[e-mail]>]

Section 11.1.1 Common requirements says:

   Each Subkey packet MUST be followed by one Signature packet, which
   should be a subkey binding signature issued by the top-level key.
   For subkeys that can issue signatures, the subkey binding signature
   MUST contain an Embedded Signature subpacket with a primary key
   binding signature (0x19) issued by the subkey on the top-level key.

   https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-07#section-11.1.4

What does it mean for a subkey to issue signatures?  I think
authentication subkeys technically issue signatures, but they don't
normally include a primary key binding signature.  For instance,
here's the `sq packet dump` output for an authentication-capable
subkey created using gpg 2.2.27:

  Public-Subkey Packet, old CTB, 397 bytes
      Version: 4
      Creation time: 2022-12-01 09:26:21 UTC
      Pk algo: RSA
      Pk size: 3072 bits
      Fingerprint: 136ABFA01DD47269514F757B10F4A631F1CB5D14
      KeyID: 10F4A631F1CB5D14

  Signature Packet, old CTB, 438 bytes
      Version: 4
      Type: SubkeyBinding
      Pk algo: RSA
      Hash algo: SHA512
      Hashed area:
        Issuer Fingerprint: 188A993D54814E76FF988779E962990F14D5ACA4
        Signature creation time: 2022-12-01 09:26:21 UTC
        Key flags: A
      Unhashed area:
        Issuer: E962990F14D5ACA4
      Digest prefix: 3C63
      Level: 0 (signature over data)

Should authentication-capable subkeys include a primary key binding
signature?  If not, perhaps it makes sense to change the language in
11.1.1 to say something like:

  if a subkey binding signature includes the Key Flags subpacket and
  the certification capability (0x1) or the signing capability (0x2)
  is set, then the subkey binding signature must also contain a valid
  primary key binding signature issued by the subkey over the primary
  key.

Neal