You should only be signing other peoples keys with your master key which should never touch an internet connected operating system. Subkeys should have limited privileges and be easy to lose or rotate as needed, but can all live under the same master offline identity key, which acts like a personal CA.