diff --git a/CMakeLists.txt b/CMakeLists.txt
index f135bab83..81e355a7e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,221 +1,222 @@
 # SPDX-FileCopyrightText: none
 # SPDX-License-Identifier: BSD-3-Clause
 cmake_minimum_required(VERSION 3.16 FATAL_ERROR)
 
 set(RELEASE_SERVICE_VERSION_MAJOR "22")
 set(RELEASE_SERVICE_VERSION_MINOR "03")
 set(RELEASE_SERVICE_VERSION_MICRO "70")
 
 # The RELEASE_SERVICE_VERSION is used by Gpg4win to add the Gpg4win version
 if (NOT RELEASE_SERVICE_VERSION)
     set(RELEASE_SERVICE_VERSION "${RELEASE_SERVICE_VERSION_MAJOR}.${RELEASE_SERVICE_VERSION_MINOR}.${RELEASE_SERVICE_VERSION_MICRO}")
 endif()
 if(RELEASE_SERVICE_VERSION_MICRO LESS 10)
     set(KDE_APPLICATIONS_COMPACT_VERSION "${RELEASE_SERVICE_VERSION_MAJOR}${RELEASE_SERVICE_VERSION_MINOR}0${RELEASE_SERVICE_VERSION_MICRO}")
 else()
     set(KDE_APPLICATIONS_COMPACT_VERSION "${RELEASE_SERVICE_VERSION_MAJOR}${RELEASE_SERVICE_VERSION_MINOR}${RELEASE_SERVICE_VERSION_MICRO}")
 endif()
 
 set(KLEOPATRA_VERSION_MAJOR "3")
 set(KLEOPATRA_VERSION_MINOR "1")
 set(KLEOPATRA_VERSION_MICRO "20")
 
 set(kleopatra_version "${KLEOPATRA_VERSION_MAJOR}.${KLEOPATRA_VERSION_MINOR}.${KLEOPATRA_VERSION_MICRO}.${KDE_APPLICATIONS_COMPACT_VERSION}")
 # The following is for Windows
 set(kleopatra_version_win "${KLEOPATRA_VERSION_MAJOR}.${KLEOPATRA_VERSION_MINOR}.${KLEOPATRA_VERSION_MICRO}")
 set(kleopatra_fileversion_win "${KLEOPATRA_VERSION_MAJOR},${KLEOPATRA_VERSION_MINOR},${KLEOPATRA_VERSION_MICRO},0")
 
 project(kleopatra VERSION ${kleopatra_version})
 
 option(DISABLE_KWATCHGNUPG "Don't build the kwatchgnupg tool [default=OFF]" OFF)
 
 # Standalone build. Find / include everything necessary.
 set(KF5_MIN_VERSION "5.89.0")
 set(KMIME_VERSION "5.19.40")
 set(LIBKLEO_VERSION "5.19.47")
 set(QT_REQUIRED_VERSION "5.15.2")
 set(GPGME_REQUIRED_VERSION "1.15.0")
 set(BOOST_REQUIRED_VERSION "1.58")
 
 if (WIN32)
   set(KF5_WANT_VERSION "5.70.0")
   set(KMIME_WANT_VERSION "5.12.0")
 else ()
   set(KF5_WANT_VERSION ${KF5_MIN_VERSION})
   set(KMIME_WANT_VERSION ${KMIME_VERSION})
 endif ()
 
 find_package(ECM ${KF5_WANT_VERSION} CONFIG REQUIRED)
 set(CMAKE_MODULE_PATH ${ECM_MODULE_PATH})
 set(CMAKE_MODULE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules ${CMAKE_MODULE_PATH})
 
 include(ECMInstallIcons)
 include(ECMSetupVersion)
 include(ECMAddTests)
 include(GenerateExportHeader)
 include(ECMGenerateHeaders)
 include(FeatureSummary)
 include(CheckFunctionExists)
 include(KDEInstallDirs)
 include(KDECMakeSettings)
 include(KDECompilerSettings NO_POLICY_SCOPE)
 include(ECMAddAppIcon)
 include(ECMQtDeclareLoggingCategory)
 
 # Find KF5 packages
 find_package(KF5WidgetsAddons ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5ConfigWidgets ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5CoreAddons ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5Codecs ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5Config ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5I18n ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5IconThemes ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5ItemModels ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5XmlGui ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5WindowSystem ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5DocTools ${KF5_WANT_VERSION} CONFIG)
 find_package(KF5Crash ${KF5_WANT_VERSION} REQUIRED)
 
 set_package_properties(KF5DocTools PROPERTIES
     DESCRIPTION "Documentation tools"
     PURPOSE "Required to generate Kleopatra documentation."
     TYPE OPTIONAL)
 
 # Optional packages
 if (WIN32)
   # Only a replacement available for Windows so this
   # is required on other platforms.
   find_package(KF5DBusAddons ${KF5_WANT_VERSION} CONFIG)
   set_package_properties(KF5DBusAddons PROPERTIES DESCRIPTION "Support library to work with DBus"
                          PURPOSE "DBus session integration"
                          URL "https://inqlude.org/libraries/kdbusaddons.html"
                          TYPE OPTIONAL)
 else()
   find_package(KF5DBusAddons ${KF5_WANT_VERSION} CONFIG REQUIRED)
   set(_kleopatra_dbusaddons_libs KF5::DBusAddons)
 endif()
 
 set(HAVE_QDBUS ${Qt5DBus_FOUND})
 
 find_package(Gpgmepp ${GPGME_REQUIRED_VERSION} CONFIG REQUIRED)
 if (Gpgmepp_VERSION VERSION_GREATER_EQUAL "1.16.0")
     set(GPGMEPP_SUPPORTS_TRUST_SIGNATURES 1)
 endif()
 find_package(QGpgme ${GPGME_REQUIRED_VERSION} CONFIG REQUIRED)
 if (QGpgme_VERSION VERSION_GREATER_EQUAL "1.16.0")
     set(QGPGME_SUPPORTS_TRUST_SIGNATURES 1)
     set(QGPGME_SUPPORTS_SIGNATURE_EXPIRATION 1)
 endif()
 if (QGpgme_VERSION VERSION_GREATER_EQUAL "1.16.1")
     set(QGPGME_SUPPORTS_CHANGING_EXPIRATION_OF_COMPLETE_KEY 1)
     set(QGPGME_CRYPTOCONFIGENTRY_HAS_DEFAULT_VALUE 1)
     set(QGPGME_SUPPORTS_WKDLOOKUP 1)
     set(QGPGME_SUPPORTS_IMPORT_WITH_FILTER 1)
     set(QGPGME_SUPPORTS_IMPORT_WITH_KEY_ORIGIN 1)
+    set(QGPGME_SUPPORTS_SECRET_SUBKEY_EXPORT 1)
 endif()
 
 # Kdepimlibs packages
 find_package(KF5Libkleo ${LIBKLEO_VERSION} CONFIG REQUIRED)
 find_package(KF5Mime ${KMIME_WANT_VERSION} CONFIG REQUIRED)
 
 find_package(Qt5 ${QT_REQUIRED_VERSION} CONFIG REQUIRED Widgets Test Network PrintSupport)
 
 find_package(Assuan2 REQUIRED)
 
 
 find_package(Boost ${BOOST_REQUIRED_VERSION} MODULE REQUIRED)
 
 find_path(Boost_TOPOLOGICAL_SORT_DIR NAMES boost/graph/topological_sort.hpp PATHS ${Boost_INCLUDE_DIRS})
 if(NOT Boost_TOPOLOGICAL_SORT_DIR)
     message(FATAL_ERROR "The Boost Topological_sort header was NOT found. Should be part of Boost graph module.")
 endif()
 
 set(kleopatra_release FALSE)
 
 if(NOT kleopatra_release)
     find_package(Git)
     if(GIT_FOUND)
         execute_process(COMMAND ${GIT_EXECUTABLE} rev-parse
                         WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
                         RESULT_VARIABLE rc
                         ERROR_QUIET)
         if(rc EQUAL 0)
             execute_process(COMMAND ${GIT_EXECUTABLE} log -1 --oneline --format=%h ${CMAKE_CURRENT_SOURCE_DIR}
                 WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
                 OUTPUT_VARIABLE Kleopatra_WC_REVISION)
             string(REGEX REPLACE "\n" "" Kleopatra_WC_REVISION "${Kleopatra_WC_REVISION}")
 
             execute_process(COMMAND ${GIT_EXECUTABLE} log -1 --oneline --format=%cI ${CMAKE_CURRENT_SOURCE_DIR}
                 WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
                 OUTPUT_VARIABLE Kleopatra_WC_LAST_CHANGED_DATE)
             string(REGEX REPLACE "^([0-9]+)-([0-9]+)-([0-9]+)T([0-9]+):([0-9]+):([0-9]+).*$" "\\1\\2\\3T\\4\\5\\6"
                    Kleopatra_WC_LAST_CHANGED_DATE "${Kleopatra_WC_LAST_CHANGED_DATE}")
 
             set(kleopatra_version "${kleopatra_version}+git${Kleopatra_WC_LAST_CHANGED_DATE}~${Kleopatra_WC_REVISION}")
         endif()
     endif()
 endif()
 
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/version-kleopatra.h.cmake ${CMAKE_CURRENT_BINARY_DIR}/version-kleopatra.h)
 
 include (ConfigureChecks.cmake)
 
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/config-kleopatra.h.cmake ${CMAKE_CURRENT_BINARY_DIR}/config-kleopatra.h)
 include_directories(
     ${CMAKE_CURRENT_BINARY_DIR}
     ${CMAKE_CURRENT_SOURCE_DIR}
     ${Boost_INCLUDE_DIRS}
     ${ASSUAN2_INCLUDES}
     )
 
 add_definitions(-D_ASSUAN_ONLY_GPG_ERRORS)
 add_definitions(-DQT_DISABLE_DEPRECATED_BEFORE=0x050e00)
 add_definitions(-DKF_DISABLE_DEPRECATED_BEFORE_AND_AT=0x055A00)
 if(CMAKE_COMPILER_IS_GNUCXX)
     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wno-missing-braces -Wno-parentheses -Wno-ignored-qualifiers")
 endif()
 add_definitions(-DQT_NO_EMIT)
 remove_definitions(-DQT_NO_FOREACH)
 
 # Disable the use of QStringBuilder for operator+ to prevent crashes when
 # returning the result of concatenating string temporaries in lambdas. We do
 # this for example in some std::transform expressions.
 # This is a known issue: https://bugreports.qt.io/browse/QTBUG-47066
 # Alternatively, one would always have to remember to force the lambdas to
 # return a QString instead of QStringBuilder, but that's just too easy to
 # forget and, unfortunately, the compiler doesn't issue a warning if one forgets
 # this. So, it's just too dangerous.
 # One can still use QStringBuilder explicitly with the operator% if necessary.
 remove_definitions(-DQT_USE_FAST_OPERATOR_PLUS)
 remove_definitions(-DQT_USE_QSTRINGBUILDER)
 
 kde_enable_exceptions()
 option(USE_UNITY_CMAKE_SUPPORT "Use UNITY cmake support (speedup compile time)" OFF)
 
 set(COMPILE_WITH_UNITY_CMAKE_SUPPORT OFF)
 if (USE_UNITY_CMAKE_SUPPORT)
     set(COMPILE_WITH_UNITY_CMAKE_SUPPORT ON)
 endif()
 
 
 add_subdirectory(pics)
 add_subdirectory(src)
 
 if(BUILD_TESTING)
     add_subdirectory(tests)
     add_subdirectory(autotests)
 endif()
 
 ecm_qt_install_logging_categories(
         EXPORT KLEOPATRA
         FILE kleopatra.categories
         DESTINATION ${KDE_INSTALL_LOGGINGCATEGORIESDIR}
         )
 
 ki18n_install(po)
 if(KF5DocTools_FOUND)
     kdoctools_install(po)
     add_subdirectory(doc)
 endif()
 feature_summary(WHAT ALL FATAL_ON_MISSING_REQUIRED_PACKAGES)
 
diff --git a/config-kleopatra.h.cmake b/config-kleopatra.h.cmake
index 01224a7e6..d1382e079 100644
--- a/config-kleopatra.h.cmake
+++ b/config-kleopatra.h.cmake
@@ -1,49 +1,52 @@
 /* Define to 1 if you have a recent enough libassuan */
 #cmakedefine HAVE_USABLE_ASSUAN 1
 
 /* Define to 1 if you have libassuan v2 */
 #cmakedefine HAVE_ASSUAN2 1
 
 #ifndef HAVE_ASSUAN2
 /* Define to 1 if your libassuan has the assuan_fd_t type  */
 #cmakedefine HAVE_ASSUAN_FD_T 1
 
 /* Define to 1 if your libassuan has the assuan_inquire_ext function */
 #cmakedefine HAVE_ASSUAN_INQUIRE_EXT 1
 
 /* Define to 1 if your assuan_inquire_ext puts the buffer arguments into the callback signature */
 #cmakedefine HAVE_NEW_STYLE_ASSUAN_INQUIRE_EXT 1
 
 /* Define to 1 if your libassuan has the assuan_sock_get_nonce function */
 #cmakedefine HAVE_ASSUAN_SOCK_GET_NONCE 1
 
 #endif
 /* Define to 1 if you build libkleopatraclient */
 #cmakedefine HAVE_KLEOPATRACLIENT_LIBRARY 1
 
 /* DBus available */
 #cmakedefine01 HAVE_QDBUS
 
 /* Defined if GpgME++ supports trust signatures */
 #cmakedefine GPGMEPP_SUPPORTS_TRUST_SIGNATURES 1
 
 /* Defined if QGpgME supports trust signatures */
 #cmakedefine QGPGME_SUPPORTS_TRUST_SIGNATURES 1
 
 /* Defined if QGpgME supports setting an expiration date for signatures */
 #cmakedefine QGPGME_SUPPORTS_SIGNATURE_EXPIRATION 1
 
 /* Defined if QGpgME supports changing the expiration date of the primary key and the subkeys simultaneously */
 #cmakedefine QGPGME_SUPPORTS_CHANGING_EXPIRATION_OF_COMPLETE_KEY 1
 
 /* Defined if QGpgME supports retrieving the default value of a config entry */
 #cmakedefine QGPGME_CRYPTOCONFIGENTRY_HAS_DEFAULT_VALUE 1
 
 /* Defined if QGpgME supports WKD lookup */
 #cmakedefine QGPGME_SUPPORTS_WKDLOOKUP 1
 
 /* Defined if QGpgME supports specifying an import filter when importing keys */
 #cmakedefine QGPGME_SUPPORTS_IMPORT_WITH_FILTER 1
 
 /* Defined if QGpgME supports setting key origin when importing keys */
 #cmakedefine QGPGME_SUPPORTS_IMPORT_WITH_KEY_ORIGIN 1
+
+/* Defined if QGpgME supports the export of secret subkeys */
+#cmakedefine QGPGME_SUPPORTS_SECRET_SUBKEY_EXPORT 1
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index a79582a86..b0f3e5cc6 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -1,388 +1,389 @@
 # SPDX-FileCopyrightText: none
 # SPDX-License-Identifier: BSD-3-Clause
 add_subdirectory(icons)
 add_subdirectory(mimetypes)
 
 include_directories(${CMAKE_CURRENT_BINARY_DIR})
 include_directories(${CMAKE_CURRENT_SOURCE_DIR})
 
 if (NOT DISABLE_KWATCHGNUPG)
     add_subdirectory(kwatchgnupg)
 endif()
 add_subdirectory(libkleopatraclient)
 add_subdirectory(conf)
 add_subdirectory(kconf_update)
 
 if(WIN32)
   set(_kleopatra_extra_uiserver_SRCS uiserver/uiserver_win.cpp)
   set(_kleopatra_extra_SRCS
       utils/gnupg-registry.c
       selftest/registrycheck.cpp
       utils/windowsprocessdevice.cpp
       utils/userinfo_win.cpp
   )
 else()
   set(_kleopatra_extra_uiserver_SRCS uiserver/uiserver_unix.cpp)
   set(_kleopatra_extra_SRCS)
 endif()
 
 set(_kleopatra_uiserver_SRCS
     uiserver/sessiondata.cpp
     uiserver/uiserver.cpp
     ${_kleopatra_extra_uiserver_SRCS}
     uiserver/assuanserverconnection.cpp
     uiserver/echocommand.cpp
     uiserver/decryptverifycommandemailbase.cpp
     uiserver/decryptverifycommandfilesbase.cpp
     uiserver/signcommand.cpp
     uiserver/signencryptfilescommand.cpp
     uiserver/prepencryptcommand.cpp
     uiserver/prepsigncommand.cpp
     uiserver/encryptcommand.cpp
     uiserver/selectcertificatecommand.cpp
     uiserver/importfilescommand.cpp
     uiserver/createchecksumscommand.cpp
     uiserver/verifychecksumscommand.cpp
 
     selftest/uiservercheck.cpp
   )
 
 if(ASSUAN2_FOUND)
   include_directories(${ASSUAN2_INCLUDES})
   set(_kleopatra_uiserver_extra_libs ${ASSUAN2_LIBRARIES})
 else()
   include_directories(${ASSUAN_INCLUDES})
   if(WIN32)
     set(_kleopatra_uiserver_extra_libs ${ASSUAN_VANILLA_LIBRARIES})
   else()
     set(_kleopatra_uiserver_extra_libs ${ASSUAN_PTHREAD_LIBRARIES})
   endif()
 endif()
 
 if(HAVE_GPG_ERR_SOURCE_KLEO)
   add_definitions(-DGPG_ERR_SOURCE_DEFAULT=GPG_ERR_SOURCE_KLEO)
   add_definitions(-DGPGMEPP_ERR_SOURCE_DEFAULT=GPG_ERR_SOURCE_KLEO)
 else()
   add_definitions(-DGPG_ERR_SOURCE_DEFAULT=GPG_ERR_SOURCE_USER_1)
   add_definitions(-DGPGMEPP_ERR_SOURCE_DEFAULT=GPG_ERR_SOURCE_USER_1)
 endif()
 
 ki18n_wrap_ui(_kleopatra_uiserver_SRCS crypto/gui/signingcertificateselectionwidget.ui)
 
 set(_kleopatra_SRCS
   utils/gui-helper.cpp
   utils/filedialog.cpp
   utils/kdpipeiodevice.cpp
   utils/headerview.cpp
   utils/scrollarea.cpp
   utils/dragqueen.cpp
   utils/multivalidator.cpp
   utils/systemtrayicon.cpp
 
   utils/hex.cpp
   utils/path-helper.cpp
   utils/input.cpp
   utils/output.cpp
   utils/validation.cpp
   utils/wsastarter.cpp
   utils/iodevicelogger.cpp
   utils/log.cpp
   utils/action_data.cpp
   utils/types.cpp
   utils/archivedefinition.cpp
   utils/auditlog.cpp
   utils/clipboardmenu.cpp
   utils/kuniqueservice.cpp
   utils/tags.cpp
   utils/writecertassuantransaction.cpp
   utils/keyparameters.cpp
   utils/userinfo.cpp
 
   selftest/selftest.cpp
   selftest/enginecheck.cpp
   selftest/gpgconfcheck.cpp
   selftest/gpgagentcheck.cpp
   selftest/libkleopatrarccheck.cpp
   selftest/compliancecheck.cpp
 
   ${_kleopatra_extra_SRCS}
 
   view/htmllabel.cpp
   view/keylistcontroller.cpp
   view/keytreeview.cpp
   view/searchbar.cpp
   view/smartcardwidget.cpp
   view/openpgpkeycardwidget.cpp
   view/padwidget.cpp
   view/pgpcardwidget.cpp
   view/pivcardwidget.cpp
   view/p15cardwidget.cpp
   view/netkeywidget.cpp
   view/nullpinwidget.cpp
   view/tabwidget.cpp
   view/keycacheoverlay.cpp
   view/urllabel.cpp
   view/waitwidget.cpp
   view/welcomewidget.cpp
 
   dialogs/certificateselectiondialog.cpp
   dialogs/certifywidget.cpp
   dialogs/expirydialog.cpp
   dialogs/lookupcertificatesdialog.cpp
   dialogs/ownertrustdialog.cpp
   dialogs/selftestdialog.cpp
   dialogs/certifycertificatedialog.cpp
   dialogs/revokecertificationwidget.cpp
   dialogs/revokecertificationdialog.cpp
   dialogs/adduseriddialog.cpp
   dialogs/addemaildialog.cpp
   dialogs/deletecertificatesdialog.cpp
   dialogs/setinitialpindialog.cpp
   dialogs/certificatedetailsdialog.cpp
   dialogs/certificatedetailswidget.cpp
   dialogs/trustchainwidget.cpp
   dialogs/weboftrustwidget.cpp
   dialogs/weboftrustdialog.cpp
   dialogs/exportdialog.cpp
   dialogs/subkeyswidget.cpp
   dialogs/gencardkeydialog.cpp
   dialogs/updatenotification.cpp
   dialogs/pivcardapplicationadministrationkeyinputdialog.cpp
   dialogs/certificatedetailsinputwidget.cpp
   dialogs/createcsrforcardkeydialog.cpp
   dialogs/groupdetailsdialog.cpp
   dialogs/editgroupdialog.cpp
 
   crypto/controller.cpp
   crypto/certificateresolver.cpp
   crypto/sender.cpp
   crypto/recipient.cpp
   crypto/task.cpp
   crypto/taskcollection.cpp
   crypto/decryptverifytask.cpp
   crypto/decryptverifyemailcontroller.cpp
   crypto/decryptverifyfilescontroller.cpp
   crypto/autodecryptverifyfilescontroller.cpp
   crypto/encryptemailtask.cpp
   crypto/encryptemailcontroller.cpp
   crypto/newsignencryptemailcontroller.cpp
   crypto/signencrypttask.cpp
   crypto/signencryptfilescontroller.cpp
   crypto/signemailtask.cpp
   crypto/signemailcontroller.cpp
   crypto/createchecksumscontroller.cpp
   crypto/verifychecksumscontroller.cpp
 
   crypto/gui/wizard.cpp
   crypto/gui/wizardpage.cpp
 
   crypto/gui/certificateselectionline.cpp
   crypto/gui/certificatelineedit.cpp
   crypto/gui/signingcertificateselectionwidget.cpp
   crypto/gui/signingcertificateselectiondialog.cpp
 
   crypto/gui/resultitemwidget.cpp
   crypto/gui/resultlistwidget.cpp
   crypto/gui/resultpage.cpp
 
   crypto/gui/newresultpage.cpp
   crypto/gui/signencryptfileswizard.cpp
 
   crypto/gui/signencryptemailconflictdialog.cpp
 
   crypto/gui/decryptverifyoperationwidget.cpp
   crypto/gui/decryptverifyfileswizard.cpp
   crypto/gui/decryptverifyfilesdialog.cpp
 
   crypto/gui/objectspage.cpp
   crypto/gui/resolverecipientspage.cpp
   crypto/gui/signerresolvepage.cpp
   crypto/gui/encryptemailwizard.cpp
   crypto/gui/signemailwizard.cpp
   crypto/gui/signencryptwidget.cpp
   crypto/gui/signencryptwizard.cpp
   crypto/gui/unknownrecipientwidget.cpp
 
   crypto/gui/verifychecksumsdialog.cpp
 
   commands/command.cpp
   commands/gnupgprocesscommand.cpp
   commands/detailscommand.cpp
   commands/exportcertificatecommand.cpp
   commands/exportgroupscommand.cpp
   commands/importcertificatescommand.cpp
   commands/importcertificatefromfilecommand.cpp
   commands/importcertificatefromclipboardcommand.cpp
   commands/importcertificatefromdatacommand.cpp
   commands/lookupcertificatescommand.cpp
   commands/reloadkeyscommand.cpp
   commands/refreshx509certscommand.cpp
   commands/refreshopenpgpcertscommand.cpp
   commands/deletecertificatescommand.cpp
   commands/decryptverifyfilescommand.cpp
   commands/signencryptfilescommand.cpp
   commands/signencryptfoldercommand.cpp
   commands/encryptclipboardcommand.cpp
   commands/signclipboardcommand.cpp
   commands/decryptverifyclipboardcommand.cpp
   commands/clearcrlcachecommand.cpp
   commands/dumpcrlcachecommand.cpp
   commands/dumpcertificatecommand.cpp
   commands/importcrlcommand.cpp
   commands/changeexpirycommand.cpp
   commands/changeownertrustcommand.cpp
   commands/changeroottrustcommand.cpp
   commands/changepassphrasecommand.cpp
   commands/certifycertificatecommand.cpp
   commands/revokecertificationcommand.cpp
   commands/selftestcommand.cpp
   commands/exportsecretkeycommand.cpp
+  commands/exportsecretsubkeycommand.cpp
   commands/exportopenpgpcertstoservercommand.cpp
   commands/adduseridcommand.cpp
   commands/newcertificatecommand.cpp
   commands/setinitialpincommand.cpp
   commands/learncardkeyscommand.cpp
   commands/checksumcreatefilescommand.cpp
   commands/checksumverifyfilescommand.cpp
   commands/exportpaperkeycommand.cpp
   commands/importpaperkeycommand.cpp
   commands/genrevokecommand.cpp
   commands/keytocardcommand.cpp
   commands/cardcommand.cpp
   commands/pivgeneratecardkeycommand.cpp
   commands/changepincommand.cpp
   commands/authenticatepivcardapplicationcommand.cpp
   commands/setpivcardapplicationadministrationkeycommand.cpp
   commands/certificatetopivcardcommand.cpp
   commands/importcertificatefrompivcardcommand.cpp
   commands/createopenpgpkeyfromcardkeyscommand.cpp
   commands/createcsrforcardkeycommand.cpp
   commands/listreaderscommand.cpp
 
   ${_kleopatra_uiserver_files}
 
   conf/configuredialog.cpp
   conf/groupsconfigdialog.cpp
   conf/groupsconfigpage.cpp
   conf/groupsconfigwidget.cpp
 
   newcertificatewizard/listwidget.cpp
   newcertificatewizard/newcertificatewizard.cpp
 
   smartcard/readerstatus.cpp
   smartcard/card.cpp
   smartcard/openpgpcard.cpp
   smartcard/netkeycard.cpp
   smartcard/pivcard.cpp
   smartcard/p15card.cpp
   smartcard/keypairinfo.cpp
   smartcard/utils.cpp
   smartcard/deviceinfowatcher.cpp
 
   accessibility/accessiblerichtextlabel.cpp
   accessibility/accessiblewidgetfactory.cpp
 
   aboutdata.cpp
   systrayicon.cpp
   kleopatraapplication.cpp
   mainwindow.cpp
   main.cpp
   kleopatra.qrc
 )
 
 if(WIN32)
   configure_file (versioninfo.rc.in versioninfo.rc)
   set(_kleopatra_SRCS ${CMAKE_CURRENT_BINARY_DIR}/versioninfo.rc ${_kleopatra_SRCS})
 endif()
 
 set (_kleopatra_SRCS conf/kleopageconfigdialog.cpp ${_kleopatra_SRCS})
 
 ecm_qt_declare_logging_category(_kleopatra_SRCS HEADER kleopatra_debug.h IDENTIFIER KLEOPATRA_LOG CATEGORY_NAME org.kde.pim.kleopatra
         DESCRIPTION "kleopatra (kleopatra)"
         OLD_CATEGORY_NAMES log_kleopatra
         EXPORT KLEOPATRA
     )
 
 
 if(KLEO_MODEL_TEST)
   add_definitions(-DKLEO_MODEL_TEST)
   set(_kleopatra_SRCS ${_kleopatra_SRCS} models/modeltest.cpp)
 endif()
 
 ki18n_wrap_ui(_kleopatra_SRCS
   dialogs/ownertrustdialog.ui
   dialogs/selectchecklevelwidget.ui
   dialogs/selftestdialog.ui
   dialogs/adduseriddialog.ui
   dialogs/setinitialpindialog.ui
   dialogs/trustchainwidget.ui
   dialogs/subkeyswidget.ui
   newcertificatewizard/listwidget.ui
   newcertificatewizard/chooseprotocolpage.ui
   newcertificatewizard/enterdetailspage.ui
   newcertificatewizard/keycreationpage.ui
   newcertificatewizard/resultpage.ui
   newcertificatewizard/advancedsettingsdialog.ui
 )
 
 kconfig_add_kcfg_files(_kleopatra_SRCS
   kcfg/tooltippreferences.kcfgc
   kcfg/emailoperationspreferences.kcfgc
   kcfg/fileoperationspreferences.kcfgc
   kcfg/smimevalidationpreferences.kcfgc
   kcfg/tagspreferences.kcfgc
   kcfg/settings.kcfgc
 )
 
 file(GLOB ICONS_SRCS "${CMAKE_CURRENT_SOURCE_DIR}/icons/*-apps-kleopatra.png")
 ecm_add_app_icon(_kleopatra_SRCS ICONS ${ICONS_SRCS})
 
 add_executable(kleopatra_bin ${_kleopatra_SRCS} ${_kleopatra_uiserver_SRCS})
 
 # For the ConfigureDialog & KCMs
 target_link_libraries(kleopatra_bin kcm_kleopatra_static)
 
 #if (COMPILE_WITH_UNITY_CMAKE_SUPPORT)
 #    set_target_properties(kleopatra_bin PROPERTIES UNITY_BUILD ON)
 #endif()
 set_target_properties(kleopatra_bin PROPERTIES OUTPUT_NAME kleopatra)
 
 if (WIN32)
   set(_kleopatra_platform_libs "secur32")
 endif ()
 
 target_link_libraries(kleopatra_bin
   Gpgmepp
   QGpgme
   ${_kleopatra_extra_libs}
   KF5::Libkleo
   KF5::Mime
   KF5::I18n
   KF5::XmlGui
   KF5::IconThemes
   KF5::WindowSystem
   KF5::CoreAddons
   KF5::ItemModels
   KF5::Crash
   Qt::Network
   Qt::PrintSupport # Printing secret keys
   ${_kleopatra_uiserver_extra_libs}
   ${_kleopatra_dbusaddons_libs}
   kleopatraclientcore
   ${_kleopatra_platform_libs}
 )
 
 install(TARGETS kleopatra_bin ${KDE_INSTALL_TARGETS_DEFAULT_ARGS})
 
 install(
   PROGRAMS data/org.kde.kleopatra.desktop data/kleopatra_import.desktop
   DESTINATION ${KDE_INSTALL_APPDIR}
 )
 install(FILES data/org.kde.kleopatra.appdata.xml DESTINATION ${KDE_INSTALL_METAINFODIR})
 install(
   PROGRAMS data/kleopatra_signencryptfiles.desktop
         data/kleopatra_signencryptfolders.desktop
         data/kleopatra_decryptverifyfiles.desktop
         data/kleopatra_decryptverifyfolders.desktop
   DESTINATION ${KDE_INSTALL_DATADIR}/kio/servicemenus
 )
diff --git a/src/commands/exportsecretsubkeycommand.cpp b/src/commands/exportsecretsubkeycommand.cpp
new file mode 100644
index 000000000..168d62c9e
--- /dev/null
+++ b/src/commands/exportsecretsubkeycommand.cpp
@@ -0,0 +1,296 @@
+/* -*- mode: c++; c-basic-offset:4 -*-
+    commands/exportsecretsubkeycommand.cpp
+
+    This file is part of Kleopatra, the KDE keymanager
+    SPDX-FileCopyrightText: 2022 g10 Code GmbH
+    SPDX-FileContributor: Ingo Klöcker <dev@ingo-kloecker.de>
+
+    SPDX-License-Identifier: GPL-2.0-or-later
+*/
+
+#include <config-kleopatra.h>
+
+#include "exportsecretsubkeycommand.h"
+#include "command_p.h"
+
+#include "fileoperationspreferences.h"
+#include "utils/filedialog.h"
+
+#include <Libkleo/Classify>
+#include <Libkleo/Formatting>
+
+#include <KConfigGroup>
+#include <KLocalizedString>
+#include <KSharedConfig>
+
+#include <QGpgME/Protocol>
+#include <QGpgME/ExportJob>
+
+#include <QFileInfo>
+#include <QStandardPaths>
+
+#include <algorithm>
+#include <memory>
+#include <vector>
+
+using namespace Kleo;
+using namespace GpgME;
+
+namespace
+{
+
+#ifdef QGPGME_SUPPORTS_SECRET_SUBKEY_EXPORT
+QString getLastUsedExportDirectory()
+{
+    KConfigGroup config{KSharedConfig::openConfig(), "ExportDialog"};
+    return config.readEntry("LastDirectory", QStandardPaths::writableLocation(QStandardPaths::DocumentsLocation));
+}
+
+void updateLastUsedExportDirectory(const QString &path)
+{
+    KConfigGroup config{KSharedConfig::openConfig(), "ExportDialog"};
+    config.writeEntry("LastDirectory", QFileInfo{path}.absolutePath());
+}
+
+QString openPGPCertificateFileExtension()
+{
+    return QLatin1String{outputFileExtension(Class::OpenPGP | Class::Ascii | Class::Certificate,
+                                             FileOperationsPreferences().usePGPFileExt())};
+}
+
+QString proposeFilename(const std::vector<Subkey> &subkeys)
+{
+    QString filename;
+
+    if (subkeys.size() == 1) {
+        const auto subkey = subkeys.front();
+        const auto key = subkey.parent();
+        auto name = Formatting::prettyName(key);
+        if (name.isEmpty()) {
+            name = Formatting::prettyEMail(key);
+        }
+        const auto shortKeyID = Formatting::prettyKeyID(key.shortKeyID());
+        const auto shortSubkeyID = Formatting::prettyKeyID(QByteArray{subkey.keyID()}.right(8).constData());
+        const auto usage = Formatting::usageString(subkey).replace(QLatin1String{", "}, QLatin1String{"_"});
+        /* Not translated so it's better to use in tutorials etc. */
+        filename += QStringView{u"%1_%2_SECRET_SUBKEY_%3_%4"}.arg(
+            name, shortKeyID, shortSubkeyID, usage);
+    } else {
+        filename += i18nc("Generic filename for exported subkeys", "subkeys");
+    }
+    filename.replace(u'/', u'_');
+
+    return getLastUsedExportDirectory() + u'/' + filename + u'.' + openPGPCertificateFileExtension();
+}
+
+QString requestFilename(const std::vector<Subkey> &subkeys, const QString &proposedFilename, QWidget *parent)
+{
+    auto filename = FileDialog::getSaveFileNameEx(
+        parent,
+        i18ncp("@title:window", "Export Subkey", "Export Subkeys", subkeys.size()),
+        QStringLiteral("imp"),
+        proposedFilename,
+        i18nc("description of filename filter", "Secret Key Files") + QLatin1String{" (*.asc *.gpg *.pgp)"});
+
+    if (!filename.isEmpty()) {
+        const QFileInfo fi{filename};
+        if (fi.suffix().isEmpty()) {
+            filename += u'.' + openPGPCertificateFileExtension();
+        }
+        updateLastUsedExportDirectory(filename);
+    }
+
+    return filename;
+}
+
+template<typename SubkeyContainer>
+QStringList getSubkeyFingerprints(const SubkeyContainer &subkeys)
+{
+    QStringList fingerprints;
+
+    fingerprints.reserve(subkeys.size());
+    std::transform(std::begin(subkeys), std::end(subkeys),
+                   std::back_inserter(fingerprints),
+                   [](const auto &subkey) {
+                       return QLatin1String{subkey.fingerprint()} + u'!';
+                   });
+
+    return fingerprints;
+}
+#endif
+
+}
+
+class ExportSecretSubkeyCommand::Private : public Command::Private
+{
+    friend class ::ExportSecretSubkeyCommand;
+    ExportSecretSubkeyCommand *q_func() const
+    {
+        return static_cast<ExportSecretSubkeyCommand *>(q);
+    }
+public:
+    explicit Private(ExportSecretSubkeyCommand *qq);
+    ~Private() override;
+
+    void start();
+    void cancel();
+
+private:
+    std::unique_ptr<QGpgME::ExportJob> startExportJob(const std::vector<Subkey> &subkeys);
+    void onExportJobResult(const Error &err, const QByteArray &keyData);
+    void showError(const Error &err);
+
+private:
+    std::vector<Subkey> subkeys;
+    QString filename;
+    QPointer<QGpgME::ExportJob> job;
+};
+
+ExportSecretSubkeyCommand::Private *ExportSecretSubkeyCommand::d_func()
+{
+    return static_cast<Private *>(d.get());
+}
+const ExportSecretSubkeyCommand::Private *ExportSecretSubkeyCommand::d_func() const
+{
+    return static_cast<const Private *>(d.get());
+}
+
+#define d d_func()
+#define q q_func()
+
+ExportSecretSubkeyCommand::Private::Private(ExportSecretSubkeyCommand *qq)
+    : Command::Private{qq}
+{
+}
+
+ExportSecretSubkeyCommand::Private::~Private() = default;
+
+void ExportSecretSubkeyCommand::Private::start()
+{
+#ifdef QGPGME_SUPPORTS_SECRET_SUBKEY_EXPORT
+    if (subkeys.empty()) {
+        finished();
+        return;
+    }
+
+    filename = requestFilename(subkeys, proposeFilename(subkeys), parentWidgetOrView());
+    if (filename.isEmpty()) {
+        canceled();
+        return;
+    }
+
+    auto exportJob = startExportJob(subkeys);
+    if (!exportJob) {
+        finished();
+        return;
+    }
+    job = exportJob.release();
+#else
+    Q_ASSERT(!"This command is not supported by the backend it was compiled against");
+    finished();
+    return;
+#endif
+}
+
+void ExportSecretSubkeyCommand::Private::cancel()
+{
+    if (job) {
+        job->slotCancel();
+    }
+    job.clear();
+}
+
+std::unique_ptr<QGpgME::ExportJob> ExportSecretSubkeyCommand::Private::startExportJob(const std::vector<Subkey> &subkeys)
+{
+#ifdef QGPGME_SUPPORTS_SECRET_SUBKEY_EXPORT
+    const bool armor = filename.endsWith(u".asc", Qt::CaseInsensitive);
+    std::unique_ptr<QGpgME::ExportJob> exportJob{QGpgME::openpgp()->secretSubkeyExportJob(armor)};
+    Q_ASSERT(exportJob);
+
+    connect(exportJob.get(), &QGpgME::ExportJob::result,
+            q, [this](const GpgME::Error &err, const QByteArray &keyData) {
+                onExportJobResult(err, keyData);
+            });
+    connect(exportJob.get(), &QGpgME::Job::progress,
+            q, &Command::progress);
+
+    const GpgME::Error err = exportJob->start(getSubkeyFingerprints(subkeys));
+    if (err) {
+        showError(err);
+        return {};
+    }
+    Q_EMIT q->info(i18nc("@info:status", "Exporting subkeys..."));
+
+    return exportJob;
+#else
+    Q_UNUSED(subkeys)
+    return {};
+#endif
+}
+
+void ExportSecretSubkeyCommand::Private::onExportJobResult(const Error &err, const QByteArray &keyData)
+{
+    if (err) {
+        showError(err);
+        finished();
+        return;
+    }
+
+    if (keyData.isEmpty()) {
+        error(i18nc("@info", "The result of the export is empty."),
+              i18nc("@title:window", "Export Failed"));
+        finished();
+        return;
+    }
+
+    QFile f{filename};
+    if (!f.open(QIODevice::WriteOnly)) {
+        error(xi18nc("@info", "Cannot open file <filename>%1</filename> for writing.", filename),
+              i18nc("@title:window", "Export Failed"));
+        finished();
+        return;
+    }
+
+    const auto bytesWritten = f.write(keyData);
+    if (bytesWritten != keyData.size()) {
+        error(xi18ncp("@info",
+                      "Writing subkey to file <filename>%1</filename> failed.",
+                      "Writing subkeys to file <filename>%1</filename> failed.",
+                      subkeys.size(), filename),
+              i18nc("@title:window", "Export Failed"));
+    }
+
+    finished();
+}
+
+void ExportSecretSubkeyCommand::Private::showError(const Error &err)
+{
+    error(xi18nc("@info",
+                 "<para>An error occurred during the export:</para>"
+                 "<para><message>%1</message></para>",
+                 QString::fromLocal8Bit(err.asString())),
+          i18nc("@title:window", "Export Failed"));
+}
+
+ExportSecretSubkeyCommand::ExportSecretSubkeyCommand(const std::vector<GpgME::Subkey> &subkeys)
+    : Command{new Private{this}}
+{
+    d->subkeys = subkeys;
+}
+
+ExportSecretSubkeyCommand::~ExportSecretSubkeyCommand() = default;
+
+void ExportSecretSubkeyCommand::doStart()
+{
+    d->start();
+}
+
+void ExportSecretSubkeyCommand::doCancel()
+{
+    d->cancel();
+}
+
+#undef d
+#undef q
+
+#include "moc_exportsecretsubkeycommand.cpp"
diff --git a/src/commands/exportsecretsubkeycommand.h b/src/commands/exportsecretsubkeycommand.h
new file mode 100644
index 000000000..eff9ed821
--- /dev/null
+++ b/src/commands/exportsecretsubkeycommand.h
@@ -0,0 +1,38 @@
+/* -*- mode: c++; c-basic-offset:4 -*-
+    commands/exportsecretsubkeycommand.h
+
+    This file is part of Kleopatra, the KDE keymanager
+    SPDX-FileCopyrightText: 2022 g10 Code GmbH
+    SPDX-FileContributor: Ingo Klöcker <dev@ingo-kloecker.de>
+
+    SPDX-License-Identifier: GPL-2.0-or-later
+*/
+
+#pragma once
+
+#include "command.h"
+
+namespace GpgME
+{
+class Subkey;
+}
+
+namespace Kleo
+{
+class ExportSecretSubkeyCommand : public Command
+{
+    Q_OBJECT
+public:
+    explicit ExportSecretSubkeyCommand(const std::vector<GpgME::Subkey> &subkeys);
+    ~ExportSecretSubkeyCommand() override;
+
+private:
+    void doStart() override;
+    void doCancel() override;
+
+private:
+    class Private;
+    inline Private *d_func();
+    inline const Private *d_func() const;
+};
+}
diff --git a/src/dialogs/subkeyswidget.cpp b/src/dialogs/subkeyswidget.cpp
index 4a6ae17f0..945d27eb1 100644
--- a/src/dialogs/subkeyswidget.cpp
+++ b/src/dialogs/subkeyswidget.cpp
@@ -1,240 +1,268 @@
-/*  SPDX-FileCopyrightText: 2016 Klarälvdalens Datakonsult AB
+/*
+    dialogs/subkeyswidget.cpp
 
+    This file is part of Kleopatra, the KDE keymanager
+    SPDX-FileCopyrightText: 2016 Klarälvdalens Datakonsult AB
     SPDX-FileCopyrightText: 2017 Bundesamt für Sicherheit in der Informationstechnik
     SPDX-FileContributor: Intevation GmbH
+    SPDX-FileCopyrightText: 2022 g10 Code GmbH
+    SPDX-FileContributor: Ingo Klöcker <dev@ingo-kloecker.de>
 
     SPDX-License-Identifier: GPL-2.0-or-later
 */
 
+#include <config-kleopatra.h>
+
 #include "subkeyswidget.h"
 #include "ui_subkeyswidget.h"
 
 #include "commands/changeexpirycommand.h"
+#ifdef QGPGME_SUPPORTS_SECRET_SUBKEY_EXPORT
+#include "commands/exportsecretsubkeycommand.h"
+#endif
 #include "commands/keytocardcommand.h"
 #include "commands/importpaperkeycommand.h"
 #include "exportdialog.h"
 
 #include <gpgme++/key.h>
 #include <gpgme++/context.h>
 
 #include <KConfigGroup>
 #include <KSharedConfig>
 #include <QDialogButtonBox>
 #include <QPushButton>
 #include <QTreeWidgetItem>
 #include <QMenu>
 
 #include <Libkleo/Formatting>
 
 Q_DECLARE_METATYPE(GpgME::Subkey)
 
 using namespace Kleo;
 using namespace Kleo::Commands;
 
 class SubKeysWidget::Private
 {
 public:
     Private(SubKeysWidget *q)
         : q(q)
     {
         ui.setupUi(q);
         ui.subkeysTree->setContextMenuPolicy(Qt::CustomContextMenu);
         connect(ui.subkeysTree, &QAbstractItemView::customContextMenuRequested,
                 q, [this](const QPoint &p) { tableContextMenuRequested(p); });
     }
 
     GpgME::Key key;
     Ui::SubKeysWidget ui;
     void tableContextMenuRequested(const QPoint &p);
 private:
     SubKeysWidget *const q;
 };
 
 void SubKeysWidget::Private::tableContextMenuRequested(const QPoint &p)
 {
     auto item = ui.subkeysTree->itemAt(p);
     if (!item) {
         return;
     }
     const auto subkey = item->data(0, Qt::UserRole).value<GpgME::Subkey>();
+    const bool isOpenPGPKey = subkey.parent().protocol() == GpgME::OpenPGP;
 
     auto menu = new QMenu(q);
     connect(menu, &QMenu::aboutToHide, menu, &QObject::deleteLater);
 
     bool hasActions = false;
 
-    if (subkey.parent().protocol() == GpgME::OpenPGP && subkey.parent().hasSecret()) {
+    if (isOpenPGPKey && subkey.parent().hasSecret()) {
         hasActions = true;
         menu->addAction(i18n("Change Expiry Date..."), q,
                 [this, subkey]() {
                     auto cmd = new ChangeExpiryCommand(subkey.parent());
                     cmd->setSubkey(subkey);
                     ui.subkeysTree->setEnabled(false);
                     connect(cmd, &ChangeExpiryCommand::finished,
                             q, [this]() {
                                 ui.subkeysTree->setEnabled(true);
                                 key.update();
                                 q->setKey(key);
                             });
                     cmd->setParentWidget(q);
                     cmd->start();
                 }
         );
     }
 
-    if (subkey.parent().protocol() == GpgME::OpenPGP && subkey.canAuthenticate()) {
+    if (isOpenPGPKey && subkey.canAuthenticate()) {
         hasActions = true;
         menu->addAction(QIcon::fromTheme(QStringLiteral("view-certificate-export")),
                 i18n("Export OpenSSH key"),
                 q, [this, subkey]() {
             QScopedPointer<ExportDialog> dlg(new ExportDialog(q));
             dlg->setKey(subkey, static_cast<unsigned int> (GpgME::Context::ExportSSH));
             dlg->exec();
         });
     }
 
     if (!subkey.isSecret()) {
         hasActions = true;
         menu->addAction(QIcon::fromTheme(QStringLiteral("view-certificate-import")),
                         i18n("Restore printed backup"),
                         q, [this, subkey] () {
             auto cmd = new ImportPaperKeyCommand(subkey.parent());
             ui.subkeysTree->setEnabled(false);
             connect(cmd, &ImportPaperKeyCommand::finished,
                     q, [this]() { ui.subkeysTree->setEnabled(true); });
             cmd->setParentWidget(q);
             cmd->start();
         });
     }
 
     if (subkey.isSecret()) {
         hasActions = true;
         auto action = menu->addAction(QIcon::fromTheme(QStringLiteral("send-to-symbolic")),
                                       i18n("Transfer to smartcard"),
                                       q, [this, subkey]() {
             auto cmd = new KeyToCardCommand(subkey);
             ui.subkeysTree->setEnabled(false);
             connect(cmd, &KeyToCardCommand::finished,
                     q, [this]() { ui.subkeysTree->setEnabled(true); });
             cmd->setParentWidget(q);
             cmd->start();
         });
         action->setEnabled(!KeyToCardCommand::getSuitableCards(subkey).empty());
     }
 
+#ifdef QGPGME_SUPPORTS_SECRET_SUBKEY_EXPORT
+    const bool isPrimarySubkey = subkey.keyID() == key.keyID();
+    if (isOpenPGPKey && subkey.isSecret() && !isPrimarySubkey) {
+        hasActions = true;
+        menu->addAction(QIcon::fromTheme(QStringLiteral("view-certificate-export")),
+                        i18n("Export secret subkey"),
+                        q, [this, subkey]() {
+            auto cmd = new ExportSecretSubkeyCommand{{subkey}};
+            ui.subkeysTree->setEnabled(false);
+            connect(cmd, &ExportSecretSubkeyCommand::finished,
+                    q, [this]() { ui.subkeysTree->setEnabled(true); });
+            cmd->setParentWidget(q);
+            cmd->start();
+        });
+    }
+#endif
+
     if (hasActions) {
         menu->popup(ui.subkeysTree->viewport()->mapToGlobal(p));
     } else {
         delete menu;
     }
 }
 
 SubKeysWidget::SubKeysWidget(QWidget *parent)
     : QWidget(parent)
     , d(new Private(this))
 {
 }
 
 SubKeysWidget::~SubKeysWidget()
 {
 }
 
 void SubKeysWidget::setKey(const GpgME::Key &key)
 {
     d->key = key;
 
     const auto currentItem = d->ui.subkeysTree->currentItem();
     const QByteArray selectedKeyFingerprint = currentItem ?
         QByteArray(currentItem->data(0, Qt::UserRole).value<GpgME::Subkey>().fingerprint()) : QByteArray();
     d->ui.subkeysTree->clear();
 
     for (const auto &subkey : key.subkeys()) {
         auto item = new QTreeWidgetItem();
         item->setData(0, Qt::DisplayRole, Formatting::prettyID(subkey.keyID()));
         item->setData(0, Qt::UserRole, QVariant::fromValue(subkey));
         item->setData(1, Qt::DisplayRole, Kleo::Formatting::type(subkey));
         item->setData(2, Qt::DisplayRole, Kleo::Formatting::creationDateString(subkey));
         item->setData(3, Qt::DisplayRole, Kleo::Formatting::expirationDateString(subkey));
         item->setData(4, Qt::DisplayRole, Kleo::Formatting::validityShort(subkey));
         switch (subkey.publicKeyAlgorithm()) {
             case GpgME::Subkey::AlgoECDSA:
             case GpgME::Subkey::AlgoEDDSA:
             case GpgME::Subkey::AlgoECDH:
                 item->setData(5, Qt::DisplayRole, QString::fromStdString(subkey.algoName()));
                 break;
             default:
                 item->setData(5, Qt::DisplayRole, QString::number(subkey.length()));
         }
         item->setData(6, Qt::DisplayRole, Kleo::Formatting::usageString(subkey));
         item->setData(7, Qt::DisplayRole, subkey.keyID() == key.keyID() ? QStringLiteral("✓") : QString());
         d->ui.subkeysTree->addTopLevelItem(item);
         if (subkey.fingerprint() == selectedKeyFingerprint) {
             d->ui.subkeysTree->setCurrentItem(item);
         }
     }
 
     const auto subkey = key.subkey(0);
     if (const char *card = subkey.cardSerialNumber()) {
         d->ui.stored->setText(i18nc("stored...", "on SmartCard with serial no. %1", QString::fromUtf8(card)));
     } else {
         d->ui.stored->setText(i18nc("stored...", "on this computer"));
     }
     d->ui.subkeysTree->resizeColumnToContents(0);
 }
 
 
 GpgME::Key SubKeysWidget::key() const
 {
     return d->key;
 }
 
 
 
 SubKeysDialog::SubKeysDialog(QWidget *parent)
     : QDialog(parent)
 {
     setWindowTitle(i18nc("@title:window", "Subkeys Details"));
     auto l = new QVBoxLayout(this);
     l->addWidget(new SubKeysWidget(this));
 
     auto bbox = new QDialogButtonBox(this);
     auto btn = bbox->addButton(QDialogButtonBox::Close);
     connect(btn, &QPushButton::clicked, this, &QDialog::accept);
     l->addWidget(bbox);
     readConfig();
 }
 
 SubKeysDialog::~SubKeysDialog()
 {
     writeConfig();
 }
 
 void SubKeysDialog::readConfig()
 {
     KConfigGroup dialog(KSharedConfig::openStateConfig(), "SubKeysDialog");
     const QSize size = dialog.readEntry("Size", QSize(820, 280));
     if (size.isValid()) {
         resize(size);
     }
 }
 
 void SubKeysDialog::writeConfig()
 {
     KConfigGroup dialog(KSharedConfig::openStateConfig(), "SubKeysDialog");
     dialog.writeEntry("Size", size());
     dialog.sync();
 }
 
 void SubKeysDialog::setKey(const GpgME::Key &key)
 {
     auto w = findChild<SubKeysWidget*>();
     Q_ASSERT(w);
     w->setKey(key);
 }
 
 GpgME::Key SubKeysDialog::key() const
 {
     auto w = findChild<SubKeysWidget*>();
     Q_ASSERT(w);
     return w->key();
 }