Minutes of the 10th OpenPGP Email Summit (2026) - OpenPGP
Projects Present
Action Items from 2025<br>vcards
PQC - Allow for v4 subkeys
Private HQC Draft
FreePG
Key Migration
Manual Key Verification using QR codes
Unobtrusive Signatures
Deterministic keys
Forward secrecy
Automatic Key Authentication
Prefer Encrypted Mail
HKPv2
Encryption subkey selection
Autocrypt
Parula demonstration (plenary)
Fingerprint Verification or Public Key Verification
JSON
Second Device and Key Backup
Unobtrusive signatures
UX Peer Review Session
PQC Migration
Expect Signed
Autocrypt v2
Confidence Levels (UI)
openpgp.org governance
Key Transparency
Dealing with Resource Exhaustion Attacks
Revocation Distribution
Key/Certificate terminology
Wrap-up Session: Action Items
Projects Present
Thunderbird
Enigmail
Hockeypuck
keys.openpgp.org
Arch
Signstar
DeltaChat
Proton
GopenPGP
OpenPGP.js
Sequoia
Red Hat
Ripasso
Ura Design
Parula
RNP
Action Items from 2025
vcards
Daniel: Some support for exporting / importing OpenPGP keys in vcards. DeltaChat and Proton both support it, but slightly differently. Wanted to make it interoperable. We did collaborate on a document on how to put an OpenPGP key in a vcard. There should be an MR in the autocrypt project. DeltaChat started supporting Proton’s format, but Proton has not yet added support for DeltaChat’s format.
https://github.com/autocrypt/autocrypt/pull/456
PQC - Allow for v4 subkeys
Aron: v4 subkeys are only allowed for encryption and only for the MUST version of the algorithm (x25519~mlkem768).
Kai: Made some experiments. MTG team made some patches for RNP. Kai tried them. The patches are not yet merged, but they work in Kai’s local build. Can produce a subkey on an existing certificate and that works. The general idea is to start testing in the development build. The problem is that once we have a new format key, classic RNP cannot load the keyring at all (not just the certificate). Will probably add two versions of the RNP library in Thunderbird to deal with this.
Aron: The draft went through last call.
Daniel: We just have to wait for ratification.
Aron: Expect it to take 15-16 weeks. We might have to wait a few more months. But it is finalized. So if you want to use it, please do.
Neal: Should we do releases?
Aron: Proton has code ready. We’re not holding it up due to the RFC number assignment. So I would say yes. Our experience limiting it to an internal release, we found some issues in Thunderbird and GnuPG.
Andrew: Are the GnuPG issues reported? We might be able to fix it in FreePG.
Aron: I’ll get back to you.
Private HQC Draft
Aron: HQC is another algorithm for PQC and is the new cool one https://pqc-hqc.org/. It’s an alternative to lattice based algoritms, but it’s not yet ready.
Falko: dkg warned us to not spoil the message of the current draft by introducing another scheme, so we didn’t do anything. Also our funding ended. BSI also does not (yet) recommend it. Adoption of HQC might be driven by someone else. Initial public draft from NIST is expected in the summer, but NIST is working very slowly perhaps due to the current financial situation so we don’t really know when that will be done.
FreePG
Andrew: We found a governance structure, which is published on the website https://freepg.org/governance/, which is also new: https://freepg.org. Authors are people who were in the DeltaChat room at the time the document was written. Currently work based on rough consensus. Assume good faith. We don’t expect that to be a problem. The main thing that we wanted was to ensure that we have a broad coalition of packagers. We have arch, fedora, nixos, etc. Currently being shipped by Gentoo as well, but as a separate package from GnuPG.
Kai: Anyone distributing this on Mac or Windows?
Andrew: Yes, we want that. Clemens from MacPorts wants to package it. Mostly my fault that nothing has happened yet. For Windows will need to go via Chocolaty.
David: Same counts for Homebrew. Tried to reach out to the current maintainers, but didn’t get a response. Don’t have any context to make things happen.
Kai: Perhaps reach out on mastadon.
Patrick: What about gpgtools?
Andrew: I reached out, but I didn’t hear anything. Next priority is mac.
Falko: What about PQC support?
Andrew: We did not yet integrate your patches. To catch everyone up: there is a patch for GnuPG from several years ago. Upstream did not merge it, but went with a different specification. (Explanation of differences between LibrePGP and IETF PQC.) We need someone who is able to clean up the patches. I think Heiko was considering looking into it. Definitely a low-priority thing for him. We would like to do it, but we don’t have a roadmap for how to do it. Suggestions welcome.
Key Migration
Andrew: Replacement key draft has been textually stable for 6-9 months. Heiko is implementing it in rpgp or rpgpie. He came back to change the requirements for the algorithms that...