* keygen.c (do_add_key_flags): Don't set the certify flag for subkeys.