Although @dave_thompson_085 provided an outstanding answer to the first part of the question (he describes the relationship between fingerprint and KeyID), I'm going to answer the remaining (3) parts of the original question.
"What does the [SC] and the [E] mean, and what does sub mean?"
I can see why nobody answered the parts about "
[SC]" & "
[E]": GPG's documentation is as cryptic as is GPG itself ;-). I spent ages trying to find express descriptions of these fields and having failed to, I found proofs for their meaning by creating keys.
If we create a key with the
--expert switch we are given values for the "
[SC]" field if we choose option 11 "set your own capabilities". Thus, we can establish that "
[SC]" relates to "Sign Certify" from "Current allowed actions":
gpg --expert --full-gen-key
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
(7) DSA (set your own capabilities)
(8) RSA (set your own capabilities)
(9) ECC and ECC
(10) ECC (sign only)
(11) ECC (set your own capabilities)
(13) Existing key
(14) Existing key from card
Your selection? 11
Possible actions for a ECDSA/EdDSA key: Sign Certify Authenticate
Current allowed actions: Sign Certify
(S) Toggle the sign capability
(A) Toggle the authenticate capability
Your selection? q
gpg --expert --full-gen-key didn't give me an option to change "
However, creating a key using
gpg --default-new-key-algo DOES:
gpg --default-new-key-algo "ed25519/cert,sign+cv25519/encr" --quick-generate-key "[email protected]"
Remark in the 2nd field between the forward slashes we see the "cert,sign" but in the 3rd field after the 2nd forward slash we see
encr is being set.
[E]" = encr[yption]
Sub[key], which Debian's excellent Wiki page describes as:
What are subkeys? OpenPGP further supports subkeys, which are like the
normal keys, except they're bound to a primary key pair. A subkey can
be used for signing or for encryption. The really useful part of
subkeys is that they can be revoked independently of the primary keys,
and also stored separately from them.
In other words, subkeys are like a separate key pair, but
automatically associated with your primary key pair.
GnuPG actually uses a signing-only key as the primary key, and creates
an encryption subkey automatically. Without a subkey for encryption,
you can't have encrypted e-mails with GnuPG at all. Debian requires
you to have the encryption subkey so that certain kinds of things can
be e-mailed to you safely, such as the initial password for your
debian.org shell account.
Finding these details- I can see others with the same questions- was like pulling teeth. GPG's docs could be a bit better. With something like encryption, there can't be ambiguity of meanings which could lead to a misapprehension...