From what I understand it is considered to be good practice to generate a private-public keypair, generate a subkey for encrypting, export all three keys and store/backup them (e.g. using 'paperkey') and then only re-import the public key and the subkey (see https://paul.fawkesley.com/gpg-for-humans-protecting-your-primary-key/ as well as https://riseup.net/en/security/message-security/openpgp/best-practices#only-use-your-primary-key-for-certification-and-possibly-signing-have-a-separate-subkey-for-encryption). In addition keys should have an expiration date (see https://riseup.net/en/security/message-security/openpgp/best-practices#use-an-expiration-date-less-than-two-years).
To update the expiration date, I currently perform the following steps manually:
gpg --import /PATH/TO/FULL-PRIVATE-KEY.asc gpg --edit-key BADC0FFE0DDF00D > expire # the main key > 1y # expire in 1 year > key 1 # select the first subkey > key 2 # select the second subkey in addition > expire # for both of the subkeys > y # perform action on both keys > 1y # expire in 1 year > save
Now I want to delete the imported private main key again. Currently I know of two methods to do that: either
gpg -K BADC0FFE0DDF00D # here I should see the key gpg --delete-secret-and-public-keys BADC0FFE0DDF00D gpg -K BADC0FFE0DDF00D # now nothing should be visible gpg --import /PATH/TO/PRIVATE-SUB-KEY.asc /PATH/TO/PUBLIC-KEY.pub
gpg -K --with-keygrip BADC0FFE0DDF00D # copy the keygrip and use it below rm -i ~/.gnupg/private-keys-v1.d/8BADF00DBEEFCACEDEFEC8EDDEADFA11.key
I dislike both methods: the first one has many steps and requires me to export and then import the (public and sub-)key files, the second one feels kind-of easy-to-get-wrong (you don't get asked for confirmation (ignoring the 'rm -i'), e.g. if that is the correct secret key you are deleting).
Isn't there anything more elegant I could do, like
gpg --delete-only-the-private-signing-key-if-you-have-already-created-other-subkeys BADC0FFE0DDF00D
or something similar? I'd appreciate any ideas!
I'm using Debian Stable (actually PureOS amber, which is based on Debian Stable) and gpg (GnuPG) 2.2.12