I suggest that the subkey-cross-certify faq say that we can import the missing
primary key, if possible, to resolve the error.