With the change for T5996 applied, the semantics is clear. "Use-for-ssh" flag is a key not for "OpenPGP.3", but other keys (not only OpenPGP.[12], but also for normal keys.)

Files affected:

configure.ac - Added chacha20 and poly1305 assembly implementations.
cipher/chacha20-p10le-8x.s (New) - support 8 blocks (512 bytes) unrolling.
cipher/poly1305-p10le.s (New) - support 4 blocks (128 bytes) unrolling.
cipher/Makefile.am - added new chacha20 and poly1305 files.
cipher/chacha20.c - Added PPC p10 le support for 8x chacha20.
cipher/poly1305.c - Added PPC p10 le support for 4x poly1305.

This feature is implemented in different way, by T5099.

Pushed the solution which doesn't require new flag for libassuan.

^-- I withdraw the solution (with error value) above.

Besides, if lower layer solution is preferred, Yubikey can support having the special BWT value 0xff when bmCommandStatus = 2 (Time extension) is returned to host. The CCID driver recognizes this special value to prompt a user the dialog window.

Please let us turn this into a fatal error again. I had too many support cases where Kleo was actually run with Admin rights and messed up the permissions. To help with development issues and for the sake of some blockheads introduce an envvar to bypass the error.

For me it is faster:

Or, it would be good for client side (in this case, gpg-agent) to specify the flag in the inquiry callback, that is, it's a kind of transient flag for a single transaction.

Revised version with new flag ASSUAN_CLEAR_INQUIRY_DATA.

Having written the code and the test I'm with dkg here. The code takes the expiration date, calculates the number of days from today and tells gpg to set the expiration to <number of days>d. The idea of the aforementioned is that it should work for any timezone. Maybe this assumption is wrong.

Subsequent downloads (also of the latest gnutls-3.7.5.tar.gz) where fast. Is there a configuration problem with loading uncached data, or was the bandwidth full at the first time?

Pushed rGea97683d5820: scd: Support automatic card selection for READCERT with keygrip..
I think that it works for PIV card.

For testing, I can use these sites for client certificate authentication:
https://stackoverflow.com/questions/38095559/https-test-server-that-checks-client-certificates