so is the signing key id the only subpacket that is allowed to go in
the unhashed area?
No, anything which might reasonably be considered to be "advisory"
and not security critical could go there. For example the URL where
the cert can be found. I don't know if there is an exhaustive list.
The point is that the software needs to be aware that material in the
unhashed region is not authenticated and could have been tampered with.
also, for a given subpacket type, can instances of
that subpacket appear in either the hashed subpacket field or the
unhashed subpacket field, or is it a mutually exclusive situation?
I don't see any problem in allowing that.
Hal