> With GPG, the only key that _has_ to be used for signing is the master key, the first key that appears in a user's key listing. For all other sub-keys, each k

> With GPG, the only key that _has_ to be used for signing is the master key, the first key that appears in a user's key listing. For all other sub-keys, each key is explicitly marked as having a specific purpose. Well it's only by-convention [0]: > By convention, the top-level key provides signature services, and the subkeys provide encryption services. [0]: https://tools.ietf.org/html/rfc4880#section-5.5.1.2 https://tools.ietf.org/html/rfc4880#section-5.5.1.2 Personally I left the main key with Certify only (disabled Sign when creating the key with expert mode) and generated signing keys as subkeys. > One important thing to note, though, is that the OpenPGP Card standard (which the Yubikey implements) has an optional flag, which requires the PIN every time you do a signature. So, for me, the authentication key is like a local agent-stored SSH key: You "unlock" it once, and then it works for a while before you have to re-enter the PIN. But for signing, I have to re-enter the PIN every time. A middle ground for encryption and authentication keys is Yubico's touch-to-use [1], you enter your PIN once and then have to touch the token to use the key. [1]: https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_touch https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_...