2

I have changed expiration date of my pgp key several times. Recently I looked at it and started to worry about the mess I can see there:

$ gpg --list-sigs AAAAAAAAAAAAAAAA
pub   4096R/AAAAAAAA 2014-11-23
uid                  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2018-03-01  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2016-04-11  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2016-11-11  Foo Bar <foo@bar.com>
uid                  Foo Bar (org) <foo@bar.org>
sig 3        AAAAAAAA 2017-10-12  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2018-03-01  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2016-04-11  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2016-11-11  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2014-11-23  Foo Bar <foo@bar.com>
uid                  Foo Bar (net) <foo@bar.net>
sig 3        AAAAAAAA 2018-03-01  Foo Bar <foo@bar.com>
sub   4096R/BBBBBBBB 2014-11-23 [expires: 2019-01-11]
sig          AAAAAAAA 2017-10-12  Foo Bar <foo@bar.com>

From What do these signatures of my PGP key mean? I know that the redundant signatures come from key manipulation.

I would like to remove them so my public key is small. I think I can use clean option of gpg --edit AAAAAAAAAAAAAAAA for that purpose.

However I wonder whether there are is any reason for which I should not remove the redundant self-signatures?

abukaj
  • 273
  • 2
  • 7

1 Answers1

2

In fact, when importing the public key, duplicate signatures are automatically removed. Because of this, anyone who imports your public key will already have a copy without the redundant signatures. Removing them yourself just makes it so that they do not need to do it themselves.

forest
  • 64,616
  • 20
  • 206
  • 257
  • I had successfully removed the redundant signatures. However as I have fetched the key (with `gpg --fetch AAAAAAAAAAAAAAAA`) they has reappeared. – abukaj Mar 14 '18 at 18:48
  • They may still exist in the keyserver, in which case the question becomes how to update the keyserver public key to remove these signatures. – forest Mar 14 '18 at 23:08
  • Weren't they supposed to be removed on import? Or is it a client - dependent behaviour? – abukaj Mar 19 '18 at 00:00
  • @abukaj Yes they should be removed on import, at least for GnuPG. – forest Mar 19 '18 at 02:01
  • It seems it is not the case at least for GnuPG 1.4.16. – abukaj Mar 22 '18 at 12:57