NAME

       sq key subkey revoke - Revoke a subkey

SYNOPSIS

       sq key subkey revoke [OPTIONS] SUBKEY REASON MESSAGE

DESCRIPTION

       Revoke a subkey.

       Creates a revocation certificate for a subkey.

       If  `--revocation-file`  is  provided,  then  that  key  is used to create the signature.  If that key is
       different from the certificate being revoked, this creates a third-party revocation.   This  is  normally
       only useful if the owner of the certificate designated the key to be a designated revoker.

       If `--revocation-file` is not provided, then the certificate must include a certification-capable key.

       `sq  key subkey revoke` respects the reference time set by the top-level `--time` argument.  When set, it
       uses the specified time instead of the current time, when determining what keys are valid,  and  it  sets
       the revocation certificate's creation time to the reference time instead of the current time.

OPTIONS

   Subcommand options
       -B, --binary
              Emit binary data

       --certificate-file=FILE
              Read  the  certificate  containing  the subkey to revoke from FILE or stdin, if omitted.  It is an
              error for the file to contain more than one certificate.

       --notation NAME VALUE
              Add a notation to the  certification.   A  user-defined  notation's  name  must  be  of  the  form
              `name@a.domain.you.control.org`.  If  the  notation's name starts with a `!`, then the notation is
              marked as being critical.  If a consumer of a signature doesn't understand  a  critical  notation,
              then it will ignore the signature.  The notation is marked as being human readable.

       -o, --output=FILE
              Write to FILE or stdout if omitted

       --private-key-store=KEY_STORE
              Provide parameters for private key store

       --revocation-file=KEY_FILE
              Sign  the  revocation  certificate  using  the  key in KEY_FILE.  If the key is different from the
              certificate, this creates a third-party revocation.  If this  option  is  not  provided,  and  the
              certificate  includes  secret  key  material,  then  that  key  is  used  to  sign  the revocation
              certificate.

        SUBKEY
              The subkey to revoke.  This must either be the subkey's Key ID or its fingerprint.

        REASON
              The reason for the revocation.  This must be either: `compromised`,  `superseded`,  `retired`,  or
              `unspecified`:

                - `compromised` means that the secret key material may have been
                  compromised.  Prefer this value if you suspect that the secret
                  key has been leaked.

                - `superseded` means that the owner of the certificate has replaced
                  it with a new certificate.  Prefer `compromised` if the secret
                  key material has been compromised even if the certificate is also
                  being replaced!  You should include the fingerprint of the new
                  certificate in the message.

                - `retired` means that this certificate should not be used anymore,
                  and there is no replacement.  This is appropriate when someone
                  leaves an organisation.  Prefer `compromised` if the secret key
                  material has been compromised even if the certificate is also
                  being retired!  You should include how to contact the owner, or
                  who to contact instead in the message.

                - `unspecified` means that none of the three other three reasons
                  apply.  OpenPGP implementations conservatively treat this type
                  of revocation similar to a compromised key.

              If  the  reason  happened  in the past, you should specify that using the `--time` argument.  This
              allows OpenPGP implementations to more accurately reason about objects whose validity  depends  on
              the validity of the certificate.

        MESSAGE
              A  short,  explanatory  text that is shown to a viewer of the revocation certificate.  It explains
              why the subkey has been revoked.  For instance, if Alice has created a new key, she would generate
              a `superseded` revocation certificate for her old key, and might include the message `I've created
              a new subkey, please refresh the certificate.`

   Global options
       See sq(1) for a description of the global options.

SEE ALSO

       sq(1), sq-key(1), sq-key-subkey(1).

       For the full documentation see <https://book.sequoia-pgp.org>.

VERSION

       0.34.0 (sequoia-openpgp 1.19.0)

Sequoia PGP                                          0.34.0                                                SQ(1)