Even if this question is quite old, I want to share a solution for this problem, which I came across, too.
Problem: I wanted to have a separate passphrase for the primary key, which I use only for certifying/creating [C] other sub keys, and the attached sub keys [S,E,A].
At the beginning there is only one passphrase for all the keys, i.e. primary and sub keys.
What I did was to backup the master key to a different location by issuing:
$ gpg --list-secret-keys --with-keygrip
which showed me the keygrip (filename of the key under ~/.gnupg/private-keys-v1.d/<your-keygrip>.key
) of the master key.
I then moved that keyfile (and the corresponding revocation certificate) to a different backup-location, and finally removed the key from ~/.gnupg/private-keys-v1.d/<your-keygrip>.key
.
(Revocation certificate is under ~/.gnupg/openpgp-revocs.d/<your-keygrip>.rev
)
After issuing gpg --list-secret-keys
I could see sec#
on the primary key, which indicates that the key is not present anymore:
sec# rsa4096/0x123123123123123 2018-02-01 [C] [expires: 2019-02-01]
Key fingerprint = 123 123 123 123 123 123 123 123 123 123
Now I just edited that key:
gpg --edit-key <your-key-id>
gpg> passwd
gpg> save
This will ask for the passphrase on each sub key, and lets you change it then.
In the end, I have a (simpler) passphrase for my sub keys, while my primary key is stored offsite, secured by the initial (stronger) passphrase.
Edit: Be aware, that this only works with GnuPG 2.1 and newer! With older GnuPG versions, you'll have to export all your keys (primary + sub), delete them and then re-import just the sub keys. Only from version 2.1 on can the primary key be deleted alone!