Edit 2025-06-17 + 2025-09-18: changed the terms according to meeting results
Especially for functional mail addresses people often share secret keys. As there is no easy way to do this the sane way (i.e. share only subkeys) a lot of people share the whole key.
To make the seemingly inevitable sharing of secrets keys more secure, we want to introduce a simple Create Team Key action.
Implementation
Add a file menu item "New OpenPGP Team Key..." after the "New OpenGPG Key..." entry.
This calls the default key creation dialog with an option to generate a "Team Key".
A certificate with separate "certify" and "sign" and encryption subkeys and the "group" flag is generated.
After generation the user is offered to "Share Secret Team Key...".
"Save Secret Team Key..." is also a menu entry after "File"->"Export...".
Tooltip: "Save this secret key to share with other team members."
The menu entry is only available if the primary key has only the capability "certify".
The function is a specialized version of the "Backup Secret Keys..." function.
Choosing this function will open a dialog:
After importing the team key, team members will be able to decrypt data with it. Please choose whether members should also be allowed to sign data with the team key. Alternatively, they can use their personal key to sign. [ ] Allow team members to sign with the team key Note: Members will not be able to change the name, email address, or expiration date of the team key. [OK] [Cancel]