A subkey is a secondary GPG key bound to a primary identity. The main key establishes the owner’s identity, while the subkey handles a narrower job such as signing releases, encrypting data, or authenticating a service. This separation limits damage if one key is exposed.
In software supply chains, release-signing subkeys are especially important because they prove that an installer or archive came from the trusted publisher and was not modified. If a subkey is copied into the wrong place, stored unencrypted, or suspected of exposure, defenders can revoke it and rotate to a fresh one without replacing the entire identity. Attackers may target subkeys because they are operationally used more often than the primary key, while defenders protect them with encryption, restricted access, hardware storage, and audit checks.