Delete only private signing key from within gpg (without reimporting subkeys or 'rm ~/.gnupg/private-keys-v1.d/KEYGRIP.key')

Question

From what I understand it is considered to be good practice to generate a private-public keypair, generate a subkey for encrypting, export all three keys and store/backup them (e.g. using 'paperkey') and then only re-import the public key and the subkey (see https://paul.fawkesley.com/gpg-for-humans-protecting-your-primary-key/ as well as https://riseup.net/en/security/message-security/openpgp/best-practices#only-use-your-primary-key-for-certification-and-possibly-signing-have-a-separate-subkey-for-encryption). In addition keys should have an expiration date (see https://riseup.net/en/security/message-security/openpgp/best-practices#use-an-expiration-date-less-than-two-years).

To update the expiration date, I currently perform the following steps manually:

gpg --import /PATH/TO/FULL-PRIVATE-KEY.asc
gpg --edit-key BADC0FFE0DDF00D
> expire      # the main key
> 1y          # expire in 1 year
> key 1       # select the first subkey
> key 2       # select the second subkey in addition
> expire      # for both of the subkeys
> y           # perform action on both keys
> 1y          # expire in 1 year
> save

Now I want to delete the imported private main key again. Currently I know of two methods to do that: either

gpg -K BADC0FFE0DDF00D         # here I should see the key
gpg --delete-secret-and-public-keys BADC0FFE0DDF00D
gpg -K BADC0FFE0DDF00D         # now nothing should be visible
gpg --import /PATH/TO/PRIVATE-SUB-KEY.asc /PATH/TO/PUBLIC-KEY.pub

or

gpg -K --with-keygrip BADC0FFE0DDF00D     # copy the keygrip and use it below
rm -i ~/.gnupg/private-keys-v1.d/8BADF00DBEEFCACEDEFEC8EDDEADFA11.key

I dislike both methods: the first one has many steps and requires me to export and then import the (public and sub-)key files, the second one feels kind-of easy-to-get-wrong (you don't get asked for confirmation (ignoring the 'rm -i'), e.g. if that is the correct secret key you are deleting).

Isn't there anything more elegant I could do, like

gpg --delete-only-the-private-signing-key-if-you-have-already-created-other-subkeys BADC0FFE0DDF00D 

or something similar? I'd appreciate any ideas!

I'm using Debian Stable (actually PureOS amber, which is based on Debian Stable) and gpg (GnuPG) 2.2.12

Answer 1

To change the expiration date, I would suggest to use

gpg --quick-set-expire  FINGERPRINT \*

which is easier to script.  See the man page (here or here) for details.

For deleting just the primary secret key you can use a regular command; for example:

$ gpg --delete-secret-key 502D1A5365D1C0CAA69945390BA52DF0BAA59D9C\!
sec  nistp256/0BA52DF0BAA59D9C 2010-09-17 ec_dsa_dh_256 <[email protected]>
Note: Only the secret part of the shown primary key will be deleted.
Delete this key from the keyring? (y/N) y
This is a secret key! - really delete? (y/N) y

Note the exclamation mark at the end of the fingerprint – it forces the use of a specific primary or subkey so that the command does not work on the entire key. The exclamation mark is quoted due to shell requirements. To avoid the confirmation prompts, add --batch and --yes.

Take care: your version 2.2.12 does not work correctly; we fixed this with 2.2.16 – so better update to the latest version (2.2.21 released in the beginning of July 2020).

---

Disclosure: I received this answer from Werner Koch @ dev.gnupg.org  in the gnupg.org-forum and wanted to share it here as well.