Server rejects OpenPGP certificates without encryption subkey

[teythoon]

Trying to add my code signing key via hkp fails with 400 bad request, and uploading via the web form reveals:

 Error! Invalid PGP key. No valid encryption key found: Could not find valid encryption key packet in key 31855247603831fd 

I think this is rather unfortunate, as having a separate OpenPGP certificate for code signing is a way to separate concerns, i.e. no signature over a git object can ever be mistaken for a signature made by my main certificate.

Other useful OpenPGP certificates without encryption subkeys are certificate revocations (note that the same composition is useful for v4 certificate revocations: the bare signature lacks context, pairing it with the primary key provides that context).

[toberndo]

Currently, the key server has the following limitations:

• in our instance on keys.mailvelope.com we send out encrypted verification emails. KOO argues that this has not security benefits, which I would agree to, but I still see a benefit of a user demonstrating the capability to decrypt a message before we accept the key on the key server.
• the key server serves only one key per identity, hence you cannot upload two separate keys for encryption and for signing
• therefore also no revocations are supported. The key server simply answers the question "What is the current key of the user?", without looking at the history.