see also https://dev.gnupg.org/T7609

This seems to apply only for non vsd compliant algos. Importing and certifying a

• rsa/brainpool cert results in security level 4
• cv25519 cert results in security level 2

Is this intended? If yes, the documentation should be more precise.

Ok, then this is only an issue in the VSD versions. (I confirmed with a quick test with Gpg4win-5.0.0-beta413)

Security Level 2 is defined as "Limited Identity Validation" and as we say in the documentation "security levels for received mails are not VS-NfD relevant, but give a clue for assessing the authenticity of the mail." one can argue that we can ignore the algorithm or this check.

But the manual which was created during the approval process states:

During signature verification and decryption, a compliant email achieves at least GpgOL security level 3 (out of four levels).

-> We have to fix our documentation instead to make clear that signatures with certificates using a not compliant algorithm will not rise above level 2.