Subject: Re: Location of 'key expiration time' signature subpacket

From: David Shaw <[email-masked]>
Date: Fri, 1 Aug 2003 17:00:54 -0400

On Tue, Jul 15, 2003 at 01:37:34PM -0400, Edwin Woudt wrote:
> 
> While implementing key expiration, I noticed that the 'key expiration time' 
> signature subpacket (#9) is put in self certification signatures instead of 
> in (self signed) direct key signature.
> 
> Why is that?
> 
> I find it more logical to put it in a direct key signature, as it says 
> nothing about the user id that is self signed. In fact, given multiple user 
> id's, putting it in self certification signatures could even result in 
> conflicting information.

It is legal to put the key expiration in a direct key signature, but
I'm not sure why it isn't regularly done that way.  Possibly because
it was done that way a long time ago and there was no dramatic reason
to change.

In any event, GnuPG does accept a key expiration set from a direct key
signature.  I'm not sure about PGP.

David