Hi,

I am using a master key (4096R/9486A82B) that has "certify" as the sole usage.
When creating a subkey on a new card using "addcardkey", the new key is
generated with no "usage" allowed at all. Afterwards, the new key is used to
create a backsignature of the master key, which then fails to verify as the
subkey is not signing capable.

I was able to work around the problem by generating the key on the computer and
using "keytocard", but that's obviously not the right way to do it.