<story><title>Deprecating SHA1</title><url>https://mailarchive.ietf.org/arch/msg/openpgp/Rp-inhYKT8A9H5E34iLTrc9I0gc/</url></story><parent_chain></parent_chain><comment><author>mkj</author><text>In case anyone else is wondering, it looks like this will show if any SHA1 signatures are involved (brew or apt install pgpdump).&lt;p&gt;&lt;pre&gt;&lt;code&gt;  gpg --export -a {keyname} | pgpdump
&lt;/code&gt;&lt;/pre&gt;
Surprised it isn&amp;#x27;t in gpg itself - maybe that&amp;#x27;s why Debian developers hadn&amp;#x27;t noticed.</text></comment>
<story><title>Deprecating SHA1</title><url>https://mailarchive.ietf.org/arch/msg/openpgp/Rp-inhYKT8A9H5E34iLTrc9I0gc/</url></story><parent_chain></parent_chain><comment><author>tgsovlerkhgsel</author><text>This is one of the many ways that shows how broken (in the &amp;quot;defective software&amp;quot; sense, not necessarily directly the cryptographic sense, yet) the entire PGP&amp;#x2F;GPG ecosystem is.</text></comment>