mjhjmtu

I'm setting up some Ubuntu servers. I received from another sysadmin a key to be added (call it somekey.pub) for apt package verification on in-house packages.

Adding this key with apt-key add somekey.pub results in TWO additional entries showing in apt-key list, each with a "pub" line and a "sub" line. (The "uid" line on both new entries is the sysadmin who gave me the key.)

How is this possible? Inspecting the key with less shows:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.22 (GNU/Linux)

(41 lines snipped)
-----END PGP PUBLIC KEY BLOCK-----

I also used gpg to create a keyring containing just that key (using gpg --no-default-keyring --keyring ./somekeyring.gpg --import somekey.pub), so that I could put the keyring in /etc/apt/trusted.gpg.d/ on other Ubuntu servers rather than running the apt-key add command.

Inspecting this keyring with gpg --no-default-keyring --keyring ./somekeyring.gpg --list-keys confirms that it has two keys. Here is the output, munged slightly:

pub 1024R/4AAAAAAA 2018-08-31
uid Joe Sysadmin (Ubuntu Dev Repo Key) <joesysadmin@example.com>
sub 1024R/9FFFFFFF 2018-08-31

pub 2048R/BAAAAAAA 2018-08-31
uid Joe Sysadmin (Ubuntu Repo Repo Key) <joesysadmin@example.com>
sub 2048R/1EEEEEEE 2018-08-31

This is my first foray into GPG and apt keys, so I may be missing some simple basic piece of information, but I would expect that the single public key block in somekey.pub would only contain a single public key - so the above results surprised me.

Where is the documentation that will allow me to make sense of this?

An OpenPGP message can be constructed of rather arbitrary OpenPGP packets -- including multiple primary keys. In fact, a "classic" GnuPG keyring not in Keybox format (.kbx) is just a single OpenPGP message with all keys lined up. The only difference to your keyring is that yours is ASCII-armored, which is just another encoding made for transmission over early communication protocols like e-mail that did only support the original 127 ASCII-characters at first.

Distributions of GnuPG usually include gpg-split, which can be used to split apart the individual OpenPGP packets. To compose them again, just concatenate them again (and gpg --enarmor if you prefer the ASCII-armored encoding).

OpenPGP would even offer a second way to include multiple OpenPGP public keys: usually and following best practice (and for some cryptographic algorithms as a technical requirement), multiple keys are created. A primary key is generated only to be used for key management (and maybe signing tasks), while one or more subkeys bound to the primary key are used for "day to day" operation. "How many OpenPGP keys should I make" offers a slightly more in-depth discussion of subkeys.