SQ(1)

💖 sq key subkey bind 💖

okay so bestie, the manual name is SQ(1) and the full command is sq key subkey bind — it's filed under sq-key-subkey-bind if you're grepping around. let's get into it 🫶

---

✨ NAME ✨

sq-key-subkey-bind — bind keys from one certificate to another. that's it, that's the whole vibe ✨

---

🌸 SYNOPSIS 🌸

sq key subkey bind [OPTIONS]

---

🦋 DESCRIPTION 🦋

So you're binding keys from one certificate to another. Literally what it says. 🎀

Here's the scenario, because ngl it's giving main character energy: this command lets you take a primary key, or a subkey that's attached to one certificate, and attach it to a different certificate. Classic use case — you wanna transition to a shiny new certificate, but your current one has an authentication subkey you're absolutely NOT letting go of, because it grants access to some server and updating that server's config is just... not feasible rn. 😭 This command makes it easy to move that subkey onto the new certificate. slay.

After the operation, the key is bound both to the old certificate and to the new one. important!! so if you wanna strip the secret key material out of the old certificate, you use sq key subkey delete or sq key delete, whichever fits the situation. And if you wanna revoke the old subkey or key? That's sq key subkey revoke or sq key revoke, respectively. periodt. 💅

---

👑 OPTIONS 👑

💜 Subcommand options

• --allow-broken-crypto — lets you adopt keys from certificates that are using broken cryptography. yep. it said what it said.
• --can-authenticate — sets the authentication-capable flag. 🔥
• --can-encrypt=PURPOSE — sets the encryption-capable flag. Encryption-capable subkeys can be marked as suitable for transport encryption, storage encryption, or both (i.e. universal). [default: universal]
  • [possible values: transport, storage, universal]
• --can-sign — sets the signing-capable flag ✨
• --cannot-authenticate — don't set the authentication-capable flag
• --cannot-encrypt — don't set the encryption-capable flag
• --cannot-sign — don't set the signing-capable flag
• --cert=FINGERPRINT|KEYID — adds the specified subkeys onto the key with the specified fingerprint or key ID
• --cert-email=EMAIL — adds the specified subkeys onto the key where a user ID includes the specified email address
• --cert-file=PATH — adds the specified subkeys to the key read from PATH
• --cert-userid=USERID — adds the specified subkeys onto the key with the specified user ID
• --creation-time=CREATION_TIME — makes the bound subkeys have the specified creation time. Normally, the key's creation time is preserved. the exception 👀 is if the key's creation time is the Unix epoch — in that case, the current time gets used instead. This option lets you set the key's creation time to a specific value. But heads up bestie: changing a key's creation time also changes its fingerprint. And changing the fingerprint makes it impossible to look up the key for the purpose of signature verification, for example. so like. be careful. 💀
• --expiration=EXPIRATION — sets the expiration time. EXPIRATION is either an ISO 8601 formatted date with an optional time, or a custom duration. A duration takes the form N[ymwds], where those letters stand for years, months, weeks, days, and seconds, respectively. Alternatively, the keyword never doesn't set an expiration time at all. [default: never]
• --key=KEY — adds the key or subkey KEY to the certificate 🔑
• --output=FILE — writes to the specified FILE. If you don't specify this, and the certificate was read from the certificate store, it imports the modified certificate into the cert store. If you don't specify it and the certificate was read from a file, it writes the modified certificate to stdout. ✨

🌈 Global options

See sq(1) for a description of the global options. (yes, there are more. go look.)

---

🍓 EXAMPLES 🍓

Bind Alice's old authentication subkey to Alice's new certificate:

sq key subkey bind \
       --cert=C5999E8191BF7B503653BE958B1F7910D01F86E5 \
       --key=0D45C6A756A038670FDFD85CB1C82E8D27DB23A1

Bind a bare key to Alice's certificate. A bare key is a public key without any components or signatures — which simplifies working with raw keys, e.g. keys generated on an OpenPGP card, a TPM device, etc. 🧚

sq key subkey bind --keyring=bare.pgp \
       --cert=C5999E8191BF7B503653BE958B1F7910D01F86E5 \
       --key=B321BA8F650CB16443E06826DBFA98A78CF6562F \
       --can-encrypt=universal

---

⭐ SEE ALSO ⭐

sq(1), sq-key(1), sq-key-subkey(1).

For the full documentation see <https://book.sequoia-pgp.org/>. 📚

---

💅 VERSION 💅

1.5.0

---

k bye bestie, go bind those keys 💖 this was Sequoia PGP, version 1.5.0, brought to you with love and 1.5.0 energy — mwah 🎀✨