Valid, unverified/verified signatures

[Damien Miller]

On Sat, 17 Oct 2026, Brian Candler wrote:

> This suggests to me that that "verified" is intended to mean "in the 
> list of allowed signers (if supplied)". The debug message you quote is 
> printed before the allowed_keys are checked, so is "unverified" at that 
> point, but is verified in a later step. There is no successful signature 
> verification path that avoids this debug message.

This is exactly correct.