[Bug 227632] RFE: better handling of signing subkeys