Here we create the master key. We want only Certify capability: we use the master key only to create the subkeys, Sign - Encrypt - Authenticate capabilities will be assigned to the subkeys.
Run the following command to start the master key generation process. Select the set your own capabilities creation process (type 8)
βΆ gpg --full-generate-key --expert
gpg (GnuPG) 2.2.9; Copyright (C) 2018 Free Software Foundation, Inc.