<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div>On 22 Dec 2020, at 13:31, Christian Chavez via Gnupg-users <<a href="mailto:gnupg-users@gnupg.org" class="">gnupg-users@gnupg.org</a>> wrote:</div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="">My question is based on this awesome answer by Thomas Pornin: <a href="https://security.stackexchange.com/a/43591" class="">https://security.stackexchange.com/a/43591</a>;<br class=""></div><div class=""><i class=""><b class="">In a work-environment, what benefits does one gain by having separate Authentication/Signing (sub)keys?</b></i><br class=""></div><div class=""><div class=""><div class=""><br class=""></div><div class="">I understand and agree with the rationale of keeping a separate Encryption key (so that this could be shared with your employer), but that rationale does not extend for Signing/Authenticating (presuming a trustworthy workplace which doesn't need to fake authentication/signing of employees).<br class=""></div></div></div></div></div></blockquote><br class=""></div><div>Keep in mind that in some workplaces the building of that trust explicitly includes the need for counter-intelligence - and hence a legitimate use of fake signatures.</div><div><br class=""></div><div>Though I have a hard time imagining a use case in the european private sector for that.</div><div><br class=""></div><div>Dw.</div><br class=""></body></html>