On 10/17/26 12:32, Brian Candler wrote: > The question then is why the debug message was worded in that way, i.e. > the signature is always reported as "valid" but "unverified". It appears > to have been present with that wording since commit 2a9c9f7 in 2019 when > signing was introduced. Thanks for the analysis. /Lars