limiting scope of signing subkeys

Vincent Breitmoser look at
Wed Jun 7 15:55:31 CEST 2017

> With (yet :-/) another flag, the program would
>relax the behavior to accept the signature when *none* of the
>*non-revoked* signing (sub)keys have the given notation.

Careful there: if the key is obtained via an untrusted channel, subkeys may be suppressed and this won't be caught by the usual fingerprint checks. This becomes relevant here, since the properties of one subkey depend on the presence of other. 

 - V

(sent from K-9 Mail)

More information about the Gnupg-devel mailing list