Best practices for dealing with OpenPGP subkeys

[ralienpp]

The subkey feature of OpenPGP compartmentalizes a system by associating multiple key-pairs with a "master" pair. Each pair can be revoked independently (i.e. when an employee leaves, or when a server was compromised).

Is such functionality exposed by SignServer? Or is it assumed that the with the use of HSMs, the keys are secure enough to make the concept of subkeys irrelevant?

[ralienpp]

@KarolinHem can you confirm that this is not supported, even in the enterprise version?

I didn't find anything about it in the docs, nor did I see anything related to it by clicking around the web interface of the enterprise version. I presume this is not available so far, but I'd like to confirm that.

In the web-interface I see that master keys are marked as such, therefore I think it is not an unreasonable assumption that subkeys are also supported (if not in the web interface, perhaps by SSHing into the server?):

[excerpt from the worker properties]

   PGP Public key:
      Master key: true