PGP uses master and sub keys for that. So essentially the master key must be kept safe and it must sign each sub key or key revocation message. So only the sub private key, master public key and the signature must be known to the client to operate. Other clients then check if the signature matches (sub key signed by master) and can be assured that the key is owned by the same entity as the last (sub) key.

Dammit, it's hard to explain that in words 😂