title: GPG Still sees good sign with revoked subkey still works
body: <p>I have created a key, and created a subkey. With a subkey, I signed a file. Verification works. Revoked the key, verification does not hold. This is the expected behavior.</p>
  
  <p>However, If I try to sign with the same subkey and verify it still works. What am I doing wrong? Here is what am I doing in full:</p>
  
  <pre><code>$ gpg --gen-key
  $ gpg -k
  /Users/mustafa/.gnupg/pubring.kbx
  ---------------------------------
  pub   rsa2048 2019-02-03 [SC] [expires: 2021-02-02]
        5DD923FBCF6392A5CB366167D4C0627A07510C6C
  uid           [ultimate] Mustafa &lt;mustafa91@gmail.com&gt;
  sub   rsa2048 2019-02-03 [E] [expires: 2021-02-02]
  </code></pre>
  
  <p>Using edit key, add a subkey.</p>
  
  <pre><code>$ gpg --edit-key 5DD923FBCF6392A5CB366167D4C0627A07510C6C
  
  sec  rsa2048/D4C0627A07510C6C
       created: 2019-02-03  expires: 2021-02-02  usage: SC
       trust: ultimate      validity: ultimate
  ssb  rsa2048/E058B91696C43666
       created: 2019-02-03  expires: 2021-02-02  usage: E
  
  gpg&gt; addkey
  
  sec  rsa2048/D4C0627A07510C6C
       created: 2019-02-03  expires: 2021-02-02  usage: SC
       trust: ultimate      validity: ultimate
  ssb  rsa2048/E058B91696C43666
       created: 2019-02-03  expires: 2021-02-02  usage: E
  ssb  rsa2048/38616BDAE66E418C
       created: 2019-02-03  expires: 2019-02-13  usage: S
  [ultimate] (1). Mustafa &lt;mustafa91@gmail.com&gt;
  
  gpg&gt; q
  Save changes? (y/N) y
  </code></pre>
  
  <p>Sign a file and verify it.</p>
  
  <pre><code>$ gpg --armor --detach-sign --default-key 38616BDAE66E418C  test.txt
  gpg: using "38616BDAE66E418C" as default secret key for signing
  
  $ gpg --verify test.txt.asc test.txt
  gpg: Signature made Sun Feb  3 21:49:43 2019 +03
  gpg:                using RSA key 485FC77FC73DA3B800C7F41538616BDAE66E418C
  gpg: Good signature from "Mustafa &lt;mustafa91@gmail.com&gt;" [ultimate]
  </code></pre>
  
  <p>Revoke the key with message "This key is now in the hands of the enemy."</p>
  
  <pre><code>$ gpg --edit-key 5DD923FBCF6392A5CB366167D4C0627A07510C6C
  gpg&gt; key 2
  
  sec  rsa2048/D4C0627A07510C6C
       created: 2019-02-03  expires: 2021-02-02  usage: SC
       trust: ultimate      validity: ultimate
  ssb  rsa2048/E058B91696C43666
       created: 2019-02-03  expires: 2021-02-02  usage: E
  ssb* rsa2048/38616BDAE66E418C
       created: 2019-02-03  expires: 2019-02-13  usage: S
  
  gpg&gt; revkey
  sec  rsa2048/D4C0627A07510C6C
       created: 2019-02-03  expires: 2021-02-02  usage: SC
       trust: ultimate      validity: ultimate
  ssb  rsa2048/E058B91696C43666
       created: 2019-02-03  expires: 2021-02-02  usage: E
  The following key was revoked on 2019-02-03 by RSA key D4C0627A07510C6C Mustafa &lt;mustafa91@gmail.com&gt;
  ssb  rsa2048/38616BDAE66E418C
       created: 2019-02-03  revoked: 2019-02-03  usage: S
  [ultimate] (1). Mustafa &lt;mustafa91@gmail.com&gt;
  </code></pre>
  
  <p>Try to verify the old signature and see it fails.</p>
  
  <pre><code>$ gpg --verify test.txt.asc test.txt
  gpg: Signature made Sun Feb  3 21:49:43 2019 +03
  gpg:                using RSA key 485FC77FC73DA3B800C7F41538616BDAE66E418C
  gpg: Good signature from "Mustafa &lt;mustafa91@gmail.com&gt;" [ultimate]
  gpg: WARNING: This subkey has been revoked by its owner!
  gpg: reason for revocation: Key has been compromised
  gpg: revocation comment: This key is now in the hands of the enemy.
  </code></pre>
  
  <p>However, trying to sign with revoked key.</p>
  
  <pre><code>$ rm test.key.asc
  $ gpg --armor --detach-sign --default-key 38616BDAE66E418C  test.txt
  gpg: using "38616BDAE66E418C" as default secret key for signing
  </code></pre>
  
  <p>Why does it not fail? How can it be verified?</p>
  
  <pre><code>$ gpg --verify test.txt.asc test.txt
  gpg: Signature made Sun Feb  3 21:53:11 2019 +03
  gpg:                using RSA key 5DD923FBCF6392A5CB366167D4C0627A07510C6C
  gpg: Good signature from "Mustafa &lt;mustafa91@gmail.com&gt;" [ultimate]
  </code></pre>