OK, now i really don't know what the issue is on the 2.4 branch. trying to replicate it with and without this patch, the --with-colons output of --check-sigs appears to depend on the order in which the certificates were ingested.

hm, digging a bit further, i think the above changes have to do with third-party signatures using SHA1, *not* with expired certifiers. in 2.4.7, i see a change from % to ! for these certifications. (2.2.x, which i know is EOL) shows the difference between ? and !. I'm trying to make a simpler replicator now.

Please test using the latest gpg4win installer (beta145).

The problem is that it may take really long to read the certificates form a card and some card applications even require to give a PIN for reading the certs. A background operation may thus surprisingly lock up the box

Which other Qt applications do we want to apply this to? Okular? GpgPass?

As this is minor anyway and does not show in kf6, I close this again

For a fresh install with version 4.0.0.250370 (Gpg4win-5.0.0-beta145) all kleo config files are below %APPDATA%\gnupg\kleoaptra:

Backported for VSD 3.3.x / Gpg4win 4.4.x