So, this SHA-1 mess is "fun". To get a fresh self-sig user ID signature on the main key, I can do this:
gpg --expert --cert-digest-algo SHA256 --sign-key ${KEYID:?}
The `--expert` overrides the "already signed" safety check, letting you
confirm that yes you really want this. Alas, it seems that
`--ask-cert-expire` is not enough, it no-ops out.
For sub-key bindings, for encryption keys it's easy: just generate a new
encryption sub-key, let it be signed with a modern hash, and future
messages encrypted to you will just use the new subkey.
For non-encryption subkeys, I'm looking really at signing subkeys: it
seems useful to make sure that existing signatures can continue to be
verified.
How do I re-sign the subkey binding for a [S] signing subkey, to keep
the same key but make the association from the main key be with SHA256
please?
Thanks,
-Phil
signature.asc
Description: Digital signature
_______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
