Is Maven artifact signing a legitimate use of GnuP

Question

I'm new to GPG signing and the intricacies are dizzying, as my other, overly-broad question indicates. So let me try to distill my current doubts into a simple question.

Let's say that a company Acme wants to sign some artifacts for publishing on Maven Central. From much research from various sources I glean the following best practices:

• Acme should have one single primary key, e.g. for [e-mail].
• Acme should generate subkeys for general day-to-day use, such as signing Maven artifacts.
• There are hardly any legitimate uses for the "comment" portion of a GPG user ID, and this field should be left blank.

Unfortunately Maven tools do not work with signing using a subkey. So that means Maven is forcing Acme to change how they manage their central identity, [e-mail]! Acme can no longer follow best practices. Most problematic is that Acme risks compromise of its central identity (e.g. for signing financial statements) if it gives the development team access to the primary key in order to sign Maven artifacts.

So to simulate subkeys, Acme could create a key for a different email address, such as [e-mail], and give that primary key to the development team for signing Maven artifacts. But then when listing keys on a public key server, a search for "Acme" would show up like this:

Acme <[e-mail]>
Acme <[e-mail]>

To me this seems confusing. I could therefore use the comment field "software" to indicate "this is the key we are using to sign software artifacts because Maven is so dense that it won't let us use subkeys of our main identity for this purpose". Thus the two Acme keys would be listed like so on a public key server:

Acme <[e-mail]>
Acme (software) <[e-mail]>

Because several writers are very adamant that most uses of the comment field are not legitimate, I ask: Is this sort of "key-purpose" designation a legitimate use of the comment of a GPG user ID? Or would it be more appropriate to use separate [e-mail] and [e-mail] keys? Or simply use one primary [e-mail] key and let the development team have access to it?

Answer 1

Comments in OpenPGP user IDs are not generally bad. They're meant for further specification of the user ID, which was not possible through using the name string and mail address. A restriction signing key might very well be such a use case.

Most people arguing against using comments is more about useless comments, which are often added because several OpenPGP implementations and user front ends seem to enforce one (just because of bad user interface design). This results in obviously superfluous comments like none, John Doe's key, My first PGP key and so on. Repeating your company name also seems unneeded, as user IDs like John Doe (ACME inc.) <[e-mail]>` indicate.

A user ID like ACME Inc. (software signing key) <[e-mail]> adds relevant information about the user ID/key. One might well derive this from key usage flags, but not everybody knows about them and they're well hidden in most OpenPGP frontends. Bonus points if you additionally restrict the key usage flags to signing (and certification, which cannot be disabled) for the primary key at the same time.