This is a good question, and I thought it would be possible to simply import the site’s signing keypair into your GnuPG keyring and then generate a revocation certificate manually. (I.e., using gpg --output revoke.asc --gen-revoke KEY_ID, where KEY_ID is the key’s fingerprint.) However, when I tried this myself I received an error, which leaves me a bit stumped.
I’m asking because I normally need a password not only to sign or encrypt e-mails but also to edit my keys.
Right, this is because, as I understand it, a revocation certificate is kind of a special signature signed by the same key itself, so you need to be able to access the private key. As is good practice, you normally encrypt the private key with a symmetric cipher (using a password), but in order for the plugin to sign outgoing emails, a password requiring human input is impractical. So the signing keypair generated by this plugin does not protect the private key with a password, under the assumption that a password accessible to the server offers no additional security in the event of a server compromise (for obvious reasons).
Therefore, you shouldn’t need a password to generate a revocation certificate as long as you can access the private key stored in the WP database generated by this plugin.
HOWEVER! Note the above error. I’ve asked the OpenPGP-PHP developers about this to see if they can provide more insight and will let you know what I learn.
