unable to update private key with subkeys

Short version: once a secring is imported into keybase with the main signing subkey empty, keybase pgp sign no longer works, and there seems to be no ability to update or add additional signing subkeys or "fill in" the original empty subkey (cannot keybase pgp purge or do another keybase pgp import or keybase pgp select)

Long version:
My pgp keyring is set up with the main pgp signing key stored off-disk for key-management only, with an additional subkey used as an active-use signing key, according to standard subkey security practices.

So on the gpg2 side:

james@enclave:~$ gpg2 -K
/home/james/.gnupg/secring.gpg
------------------------------
sec#  4096R/0x88AA092BED38F032 2016-09-15 [expires: 2019-01-02]
...
ssb   4096R/0x46FFE73D4F2134D5 2016-09-15
ssb   4096R/0x817E107870289749 2016-09-15

Where the main 0x88AA... signing key is stored empty and 0x817E... is used for signing. This works fine with gpg2:

james@enclave:~$ echo "hello" | gpg2 --armor -e -s -r james@analogist.net | gpg2 -d
...
hello
gpg: Signature made Thu 15 Sep 2016 12:13:41 AM PDT
gpg:                using RSA key 0x817E107870289749
...

I did a keybase pgp select, which successfully read my secring.gpg. Unfortunately, keybase doesn't seem to know about the second signing subkey. Encryption is successful, since the signing subkey exists:

james@enclave:~$ echo "hello" | keybase pgp encrypt
-----BEGIN PGP MESSAGE-----
Comment: https://keybase.io/download
Version: Keybase Go 1.0.17 (linux)
...

but signing fails

james@enclave:~$ echo "hello" | keybase pgp sign
▶ ERROR Bad key found: no private key material or GPGKey

This is of course fine since I didn't quite expect keybase to currently have the feature set to handle this type of use case; it's not designed for this anyway. But the problem now is that I have no ability to update the internal keybase keyring to do anything else:

james@enclave:~$ gpg2 --armor --export-secret-subkeys 0x817E107870289749 | keybase pgp import
▶ ERROR This key is already active. You can't add it twice. (error 923)

james@enclave:~$ keybase pgp select
▶ ERROR You already have a PGP key registered (6413 5645 E502 C5BD EC7E 97FD 88AA 092B ED38 F032)
Specify the `--multi` flag to override this check

james@enclave:~$ keybase pgp purge
▶ ERROR Bad key found: no private key material or GPGKey

The last one surprised me, since as far as I can tell this is the recommended thing to do if the user wanted to dissociate pgp actions from keybase entirely, but it seems to want to verify the keys before it's able to purge them. At this point I seem to be stuck not being able to add or change existing private keys.

I'm a bit afraid to keybase pgp drop, because I'm not sure the client will allow me (or should allow me) to re-use the same key that the back-end already knows about.

my log id: 66f6584f4f14ba461130891c

Start by reproducing the reported keybase pgp select, import, sign, and purge commands with a keyring whose primary signing key lacks private material but has signing subkeys. Trace the PGP key-management paths handling existing keys and subkey updates; done means the key can be updated or safely purged without blocking valid operations.