There is an option in gpg since February 2023 to configure a designated revoker for all new keys (--add-desig-revoker).
We should add another feature: Iff this option is configured, gpg shall try to load the requested key from LDAP in the same manner as it does for a trusted-key.
| rG GnuPG | |||
| rG5e1ce8adf244 gpg: Implement the LDAP AKL mechanism | |||
| rG753175c74e9d gpg: Autoload designated revoker key and ADSK when needed. | |||
| rG330354972a27 gpg: Autoload designated revoker key and ADSK when needed. | |||
| rG465ea9116d1f gpg: Autoload designated revoker key and ADSK when needed. | |||
Do I understand this correctly, that on CLI key generation the public key of the designated revoker should be fetched automatically?
On vsd-3.3.7-beta90.9 @ win10 this does not work:
>gpg -vvv --add-desig-revoker F2610788330B5FED333A62841600B31C4D9DAB34 --quick-gen-key "to be revoked" [...] Continue? (Y/n) gpg: invalid revocation key 'F2610788330B5FED333A62841600B31C4D9DAB34': No public key
>gpg -vvv --add-desig-revoker F2610788330B5FED333A62841600B31C4D9DAB34 --full-gen-key [...] Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o gpg: invalid revocation key 'F2610788330B5FED333A62841600B31C4D9DAB34': No public key
The cert is found on LDAP though:
>gpg --search-keys F2610788330B5FED333A62841600B31C4D9DAB34 [...] (1) designated revoker <designated.revoker@gnupg.test> 3072 bit RSA key 1600B31C4D9DAB34, created: 2026-04-16, expires: 2029-04-16
Looks good to me on vsd-3.4.0-beta1344, gpg 2.2.56-beta5 @ win10:
C:\Users\g10>gpg -k download
gpg: error reading key: No public key
C:\Users\g10>gpg --yes --add-desig-revoker D9DF7577C3FD36B2C94947F84E93E9CCFABA81DA --quick-gen-key with-desig-revoker
gpg: key 4E93E9CCFABA81DA: public key "download <download@ldap.test>" imported
gpg: Total number processed: 1
gpg: imported: 1
[...]
C:\Users\g10>gpg -k download
pub rsa3072 2026-09-01 [SC] [expires: 2029-08-31]
D9DF7577C3FD36B2C94947F84E93E9CCFABA81DA
uid [ unknown] download <download@ldap.test>
sub rsa3072 2026-09-01 [E]