Vendor
A vulnerability in the sequoia-openpgp library allows attackers to bypass back-signature checks and forge subkey bindings due to incorrect key flag inference.