gpg keyserver duplicates signatures on my key

Question

I created a new GPG key (rsa + rsa subkey), let's call it key1, and uploaded it to the keyserver. It has two uids.

Later I signed this new key with another key (let's call it key2), and uploaded the change. So the key now has the following signatures:

first uid:
    signed by key1
    signed by key2
second uid:
    signed by key1
    signed by key2
key1 - subkey;
    signed by key1

This is all like expected. Later I refreshed my keys from the keyserver and key1 got two new signatures. Those two signatures where duplicates of those by key1, so the key now looks like this:

first uid:
    signed by key1
    signed by key2
    signed by key1 <- duplicate
second uid:
    signed by key1
    signed by key2
    signed by key1
key1 - subkey;
    signed by key1

Why does the keyserver duplicate those signatures? Do they serve any special purpose, or is this just a bug?

Answer 1

Assuming you're referring to the "sig 3" signatures listed for the key you made the same day as this post (I checked the domain in your profile on the servers), it should be fine and it's unlikely to be the keyservers actually adding or replicating an existing signature.

It is far more likely to be an indication of any changes made to the key following generation (e.g. changing the cipher preference order, adding or removing ciphers and digests, adding or revoking subkeys, adding or revoking UIDs, etc.). When a change like this is made to a key, including when the key is generated, that data is signed by the certification key (optionally with a specific trust level, though some data must be self-signed at level 3 ("sig 3"). When this happens, each UID on the key at that time receives another "self-signature". You can see the full details by running the key through pgpdump or gpg --list-packets.

If you use pgpdump and pipe the output to a text file you can read each change to your key chronologically by starting at the bottom and moving up and forward (usually, sometimes things appear to be saved out of place or with the more normal top down, but since all changes are timestamped it should be easily worked out). To limit the output to just the changes you've made you can export a minimal or clean version of the key with:

# Normal export:
gpg -o mykey.gpg --export 0xDEADBEEF
gpg -o mykey.asc -a --export 0xDEADBEEF
#
# Clean export:
gpg -o mykey.gpg --export --export-options export-clean 0xDEADBEEF
gpg -o mykey.asc -a --export --export-options export-clean 0xDEADBEEF
#
# Minimal export (smallest):
gpg -o mykey.gpg --export --export-options export-minimal 0xDEADBEEF
gpg -o mykey.asc -a --export --export-options export-minimal 0xDEADBEEF

I recommend using the last one (with the .gpg extension, because you can also use those as separate keyring files if you really want to).

My key, for example includes cipher preference changes a couple of times as new information came to light of flaws in 3DES and CAST5. Those changes are clearly visible in pgpdump, but when using --list-sigs all that is shown is additional "sig 3" signatures at the end of each UID's listed signatures.

I haven't examined your key too closely, but it's probably just a case of you saving some change or something to the key.