On: GnuPG 2.2.23

[melvyn2]

I can't seem to use minisign with git, which is my main use for gpg.

[dependenttypes → melvyn2]

Signing git commits is broken anyway as you are basically signing the commit hash (which is a sha1, whose collision resistance is broken).

[cordite → dependenttypes]

I recall hearing github is planning on Sha-256 some time

[some_furry → cordite]

They're more likely to employ counter-cryptanalysis [1] in the meantime.

[1] https://github.com/cr-marcstevens/sha1collisiondetection