NAME

       subkey - Revoke a subkey

SYNOPSIS

       subkey  [--certificate]  [--revocation-key] [--private-key-store] [-t|--time] [--notation]
       [-B|--binary] [-h|--help] <SUBKEY> <REASON> <MESSAGE>

DESCRIPTION

       Revokes a subkey

       Creates a revocation certificate for a subkey.

       If "--revocation-key" is provided, then that key is used to create the signature.  If that
       key  is  different  from  the  certificate  being  revoked,  this  creates  a  third-party
       revocation.  This is normally only useful if the owner of the certificate  designated  the
       key to be a designated revoker.

       If   "--revocation-key"   is   not   provided,   then   the  certificate  must  include  a
       certification-capable key.

OPTIONS

       --certificate=FILE
              Reads the certificate containing the subkey  to  revoke  from  FILE  or  stdin,  if
              omitted.  It is an error for the file to contain more than one certificate.

       --revocation-key=KEY
              Signs  the  revocation  certificate  using  KEY.   If the key is different from the
              certificate, this  creates  a  third-party  revocation.   If  this  option  is  not
              provided,  and  the certificate includes secret key material, then that key is used
              to sign the revocation certificate.

       --private-key-store=KEY_STORE
              Provides parameters for private key store

       -t, --time=TIME
              Chooses keys valid at the specified time  and  sets  the  revocation  certificate's
              creation time

       --notation=NAME VALUE
              Adds  a  notation  to the certification.  A user-defined notation's name must be of
              the form "name@a.domain.you.control.org". If the notation's name starts with  a  !,
              then  the  notation  is  marked  as  being  critical.  If a consumer of a signature
              doesn't understand a critical notation, then it will  ignore  the  signature.   The
              notation is marked as being human readable.

       -B, --binary
              Emits binary data

       -h, --help
              Print help information

       <SUBKEY>
              The subkey to revoke.  This must either be the subkey's Key ID or its fingerprint.

       <REASON>
              The  reason  for  the  revocation.   This  must be either: compromised, superseded,
              retired, or unspecified:

                - compromised means that the secret key material may have been
                  compromised.  Prefer this value if you suspect that the secret
                  key has been leaked.

                - superseded means that the owner of the certificate has replaced
                  it with a new certificate.  Prefer "compromised" if the secret
                  key material has been compromised even if the certificate is
                  also being replaced!  You should include the fingerprint of the
                  new certificate in the message.

                - retired means that this certificate should not be used anymore,
                  and there is no replacement.  This is appropriate when someone
                  leaves an organisation.  Prefer "compromised" if the secret key
                  material has been compromised even if the certificate is also
                  being retired!  You should include how to contact the owner, or
                  who to contact instead in the message.

                - unspecified means that none of the three other three reasons
                  apply.  OpenPGP implementations conservatively treat this type
                  of revocation similar to a compromised key.

              If the reason happened in the past,  you  should  specify  that  using  the  --time
              argument.   This  allows  OpenPGP  implementations  to more accurately reason about
              objects whose validity depends on the validity of the certificate.

       <MESSAGE>
              A short, explanatory text that is shown to a viewer of the revocation  certificate.
              It  explains why the subkey has been revoked.  For instance, if Alice has created a
              new key, she would generate a 'superseded' revocation certificate for her old  key,
              and  might  include  the  message  "I've  created  a new subkey, please refresh the
              certificate.

SEE ALSO

       For the full documentation see <https://docs.sequoia-pgp.org/sq/>.

       sq(1) sq-armor(1) sq-autocrypt(1) sq-certify(1) sq-dearmor(1) sq-decrypt(1)  sq-encrypt(1)
       sq-inspect(1)    sq-key(1)   sq-keyring(1)   sq-keyserver(1)   sq-packet(1)   sq-revoke(1)
       sq-revoke-certificate(1) sq-revoke-userid(1) sq-sign(1) sq-verify(1) sq-wkd(1)