diff --git a/CMakeLists.txt b/CMakeLists.txt
index 376827c9d..d077d9bed 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,298 +1,298 @@
 # SPDX-FileCopyrightText: none
 # SPDX-License-Identifier: BSD-3-Clause
 cmake_minimum_required(VERSION 3.16 FATAL_ERROR)
 
 set(RELEASE_SERVICE_VERSION_MAJOR "23")
 set(RELEASE_SERVICE_VERSION_MINOR "11")
 set(RELEASE_SERVICE_VERSION_MICRO "70")
 
 # The RELEASE_SERVICE_VERSION is used by Gpg4win to add the Gpg4win version
 if (NOT RELEASE_SERVICE_VERSION)
     set(RELEASE_SERVICE_VERSION "${RELEASE_SERVICE_VERSION_MAJOR}.${RELEASE_SERVICE_VERSION_MINOR}.${RELEASE_SERVICE_VERSION_MICRO}")
 endif()
 if(RELEASE_SERVICE_VERSION_MICRO LESS 10)
     set(KDE_APPLICATIONS_COMPACT_VERSION "${RELEASE_SERVICE_VERSION_MAJOR}${RELEASE_SERVICE_VERSION_MINOR}0${RELEASE_SERVICE_VERSION_MICRO}")
 else()
     set(KDE_APPLICATIONS_COMPACT_VERSION "${RELEASE_SERVICE_VERSION_MAJOR}${RELEASE_SERVICE_VERSION_MINOR}${RELEASE_SERVICE_VERSION_MICRO}")
 endif()
 
 set(KLEOPATRA_VERSION_MAJOR "3")
 set(KLEOPATRA_VERSION_MINOR "1")
 set(KLEOPATRA_VERSION_MICRO "28")
 
 set(kleopatra_version "${KLEOPATRA_VERSION_MAJOR}.${KLEOPATRA_VERSION_MINOR}.${KLEOPATRA_VERSION_MICRO}.${KDE_APPLICATIONS_COMPACT_VERSION}")
 # The following is for Windows
 set(kleopatra_version_win "${KLEOPATRA_VERSION_MAJOR}.${KLEOPATRA_VERSION_MINOR}.${KLEOPATRA_VERSION_MICRO}")
 set(kleopatra_fileversion_win "${KLEOPATRA_VERSION_MAJOR},${KLEOPATRA_VERSION_MINOR},${KLEOPATRA_VERSION_MICRO},0")
 if (NOT KLEOPATRA_DISTRIBUTION_TEXT)
     # This is only used on Windows for the file attributes of Kleopatra
     set(KLEOPATRA_DISTRIBUTION_TEXT "KDE")
 endif()
 
 project(kleopatra VERSION ${kleopatra_version})
 
 option(DISABLE_KWATCHGNUPG "Don't build the kwatchgnupg tool [default=OFF]" OFF)
 
 # Standalone build. Find / include everything necessary.
 set(KF_MIN_VERSION "5.105.0")
 set(KIDENTITYMANAGEMENT_VERSION "5.24.40")
 set(KMAILTRANSPORT_VERSION "5.24.40")
 set(AKONADI_MIME_VERSION "5.24.40")
 set(KMIME_VERSION "5.24.40")
-set(LIBKLEO_VERSION "5.24.41")
+set(LIBKLEO_VERSION "5.24.42")
 set(MIMETREEPARSER_VERSION "5.24.41")
 set(QT_REQUIRED_VERSION "5.15.2")
 if (QT_MAJOR_VERSION STREQUAL "6")
     set(QT_REQUIRED_VERSION "6.4.0")
 endif()
 set(GPGME_REQUIRED_VERSION "1.16.0")
 set(LIBASSUAN_REQUIRED_VERSION "2.4.2")
 set(GPG_ERROR_REQUIRED_VERSION "1.36")
 
 if (WIN32)
   set(KF5_WANT_VERSION "5.104.0")
   set(KMIME_WANT_VERSION "5.12.0")
 else ()
   set(KF5_WANT_VERSION ${KF_MIN_VERSION})
   set(KMIME_WANT_VERSION ${KMIME_VERSION})
 endif ()
 
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
 find_package(ECM ${KF5_WANT_VERSION} CONFIG REQUIRED)
 set(CMAKE_MODULE_PATH ${ECM_MODULE_PATH})
 set(CMAKE_MODULE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules ${CMAKE_MODULE_PATH})
 
 include(ECMInstallIcons)
 include(ECMSetupVersion)
 include(ECMAddTests)
 include(GenerateExportHeader)
 include(ECMGenerateHeaders)
 include(FeatureSummary)
 include(CheckFunctionExists)
 include(KDEInstallDirs)
 include(KDECMakeSettings)
 include(KDECompilerSettings NO_POLICY_SCOPE)
 include(ECMAddAppIcon)
 include(ECMQtDeclareLoggingCategory)
 include(ECMDeprecationSettings)
 include(KDEClangFormat)
 include(KDEGitCommitHooks)
 
 if (QT_MAJOR_VERSION STREQUAL "6")
     set(QT_REQUIRED_VERSION "6.4.0")
     set(KF_MIN_VERSION "5.240.0")
     set(KF_MAJOR_VERSION "6")
 else()
     set(KF_MIN_VERSION "5.105.0")
     set(KF_MAJOR_VERSION "5")
 endif()
 
 # Find KF5 packages
 find_package(KF${KF_MAJOR_VERSION} ${KF5_WANT_VERSION}
     REQUIRED COMPONENTS
     Codecs
     Config
     ConfigWidgets
     CoreAddons
     Crash
     I18n
     IconThemes
     ItemModels
     KCMUtils
     KIO
     WidgetsAddons
     WindowSystem
     XmlGui
 
     OPTIONAL_COMPONENTS
     DocTools
 )
 
 set_package_properties(KF${KF_MAJOR_VERSION}DocTools PROPERTIES
     DESCRIPTION "Documentation tools"
     PURPOSE "Required to generate Kleopatra documentation."
     TYPE OPTIONAL)
 
 # Optional packages
 if (WIN32)
   # Only a replacement available for Windows so this
   # is required on other platforms.
   find_package(KF${KF_MAJOR_VERSION}DBusAddons ${KF5_WANT_VERSION} CONFIG)
   set_package_properties(KF${KF_MAJOR_VERSION}DBusAddons PROPERTIES DESCRIPTION "Support library to work with DBus"
                          PURPOSE "DBus session integration"
                          URL "https://inqlude.org/libraries/kdbusaddons.html"
                          TYPE OPTIONAL)
 else()
   find_package(KF${KF_MAJOR_VERSION}DBusAddons ${KF5_WANT_VERSION} CONFIG REQUIRED)
   set(_kleopatra_dbusaddons_libs KF${KF_MAJOR_VERSION}::DBusAddons)
 endif()
 
 set(HAVE_QDBUS ${Qt${QT_MAJOR_VERSION}DBus_FOUND})
 
 find_package(Gpgmepp ${GPGME_REQUIRED_VERSION} CONFIG REQUIRED)
 if (Gpgmepp_VERSION VERSION_GREATER_EQUAL "1.19.0")
     set(GPGMEPP_SUPPORTS_SET_CURVE 1)
 endif()
 if (Gpgmepp_VERSION VERSION_GREATER_EQUAL "1.19.1")
     set(GPGMEPP_KEY_CANSIGN_IS_FIXED 1)
 endif()
 set(QGPGME_NAME "QGpgme")
 find_package(${QGPGME_NAME} ${GPGME_REQUIRED_VERSION} CONFIG REQUIRED)
 if (${QGPGME_NAME}_VERSION VERSION_GREATER_EQUAL "1.17.0")
     set(QGPGME_SUPPORTS_CHANGING_EXPIRATION_OF_COMPLETE_KEY 1)
     set(QGPGME_CRYPTOCONFIGENTRY_HAS_DEFAULT_VALUE 1)
     set(QGPGME_SUPPORTS_WKDLOOKUP 1)
     set(QGPGME_SUPPORTS_IMPORT_WITH_FILTER 1)
     set(QGPGME_SUPPORTS_IMPORT_WITH_KEY_ORIGIN 1)
     set(QGPGME_SUPPORTS_SECRET_KEY_EXPORT 1)
     set(QGPGME_SUPPORTS_SECRET_SUBKEY_EXPORT 1)
     set(QGPGME_SUPPORTS_RECEIVING_KEYS_BY_KEY_ID 1)
 endif()
 if (${QGPGME_NAME}_VERSION VERSION_GREATER_EQUAL "1.18.0")
     set(QGPGME_SUPPORTS_KEY_REVOCATION 1)
     set(QGPGME_SUPPORTS_KEY_REFRESH 1)
     set(QGPGME_SUPPORTS_SET_FILENAME 1)
     set(QGPGME_SUPPORTS_SET_PRIMARY_UID 1)
 endif()
 if (${QGPGME_NAME}_VERSION VERSION_GREATER_EQUAL "1.19.0")
     set(QGPGME_SUPPORTS_DEFERRED_IMPORT_JOB 1)
     set(QGPGME_SUPPORTS_ARCHIVE_JOBS 1)
     set(QGPGME_JOB_HAS_NEW_PROGRESS_SIGNALS 1)
 endif()
 if (${QGPGME_NAME}_VERSION VERSION_GREATER_EQUAL "1.21.0")
     set(QGPGME_ARCHIVE_JOBS_SUPPORT_OUTPUT_FILENAME 1)
     set(QGPGME_ARCHIVE_JOBS_SUPPORT_INPUT_FILENAME 1)
 endif()
 if (${QGPGME_NAME}_VERSION VERSION_GREATER_EQUAL "1.21.1")
     set(QGPGME_HAS_TOLOGSTRING 1)
     set(QGPGME_SUPPORTS_IS_MIME 1)
 endif()
 if (${QGPGME_NAME}_VERSION VERSION_GREATER_EQUAL "1.22.1")
     set(QGPGME_SUPPORTS_WKD_REFRESH_JOB 1)
 endif()
 
 if (QT_MAJOR_VERSION STREQUAL "6")
     find_package(Qt6Core5Compat)
 endif()
 
 # Kdepimlibs packages
 find_package(KPim${KF_MAJOR_VERSION}Libkleo ${LIBKLEO_VERSION} CONFIG REQUIRED)
 find_package(KPim${KF_MAJOR_VERSION}Mime ${KMIME_WANT_VERSION} CONFIG REQUIRED)
 find_package(KPim${KF_MAJOR_VERSION}IdentityManagement ${KIDENTITYMANAGEMENT_VERSION} CONFIG)
 find_package(KPim${KF_MAJOR_VERSION}MailTransport ${KMAILTRANSPORT_VERSION} CONFIG)
 find_package(KPim${KF_MAJOR_VERSION}AkonadiMime ${AKONADI_MIME_VERSION} CONFIG)
 find_package(KPim${KF_MAJOR_VERSION}MimeTreeParserWidgets ${MIMETREEPARSER_VERSION} CONFIG REQUIRED)
 
 find_package(Qt${QT_MAJOR_VERSION} ${QT_REQUIRED_VERSION} CONFIG REQUIRED Widgets Test Network PrintSupport)
 
 find_package(LibAssuan ${LIBASSUAN_REQUIRED_VERSION} REQUIRED)
 set_package_properties(LibAssuan PROPERTIES
   TYPE REQUIRED
   PURPOSE "Needed for Kleopatra to act as the GnuPG UI Server"
 )
 find_package(LibGpgError ${GPG_ERROR_REQUIRED_VERSION} REQUIRED)
 set_package_properties(LibGpgError PROPERTIES
   TYPE REQUIRED
 )
 
 set(kleopatra_release FALSE)
 
 if(NOT kleopatra_release)
     find_package(Git)
     if(GIT_FOUND)
         execute_process(COMMAND ${GIT_EXECUTABLE} rev-parse
                         WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
                         RESULT_VARIABLE rc
                         ERROR_QUIET)
         if(rc EQUAL 0)
             execute_process(COMMAND ${GIT_EXECUTABLE} log -1 --oneline --format=%h ${CMAKE_CURRENT_SOURCE_DIR}
                 WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
                 OUTPUT_VARIABLE Kleopatra_WC_REVISION)
             string(REGEX REPLACE "\n" "" Kleopatra_WC_REVISION "${Kleopatra_WC_REVISION}")
 
             execute_process(COMMAND ${GIT_EXECUTABLE} log -1 --oneline --format=%cI ${CMAKE_CURRENT_SOURCE_DIR}
                 WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
                 OUTPUT_VARIABLE Kleopatra_WC_LAST_CHANGED_DATE)
             string(REGEX REPLACE "^([0-9]+)-([0-9]+)-([0-9]+)T([0-9]+):([0-9]+):([0-9]+).*$" "\\1\\2\\3T\\4\\5\\6"
                    Kleopatra_WC_LAST_CHANGED_DATE "${Kleopatra_WC_LAST_CHANGED_DATE}")
 
             set(kleopatra_version "${kleopatra_version}+git${Kleopatra_WC_LAST_CHANGED_DATE}~${Kleopatra_WC_REVISION}")
         endif()
     endif()
 endif()
 
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/version-kleopatra.h.cmake ${CMAKE_CURRENT_BINARY_DIR}/version-kleopatra.h)
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/config-kleopatra.h.cmake ${CMAKE_CURRENT_BINARY_DIR}/config-kleopatra.h)
 
 include_directories(
     ${CMAKE_CURRENT_BINARY_DIR}
     ${CMAKE_CURRENT_SOURCE_DIR}
 )
 
 if (WIN32)
 # On Windows, we need to use stuff deprecated since Qt 5.11, e.g. from QDesktopWidget
 ecm_set_disabled_deprecation_versions(QT 5.10.0  KF 5.103.0)
 else ()
 ecm_set_disabled_deprecation_versions(QT 6.4  KF 5.103.0)
 endif ()
 
 if(CMAKE_COMPILER_IS_GNUCXX)
     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wno-missing-braces -Wno-parentheses -Wno-ignored-qualifiers")
 endif()
 if(MINGW)
     # we do not care about different signedness of passed pointer arguments
     add_compile_options($<$<COMPILE_LANGUAGE:C>:-Wno-pointer-sign>)
 endif()
 
 add_definitions(-DQT_NO_EMIT)
 remove_definitions(-DQT_NO_FOREACH)
 
 # Disable the use of QStringBuilder for operator+ to prevent crashes when
 # returning the result of concatenating string temporaries in lambdas. We do
 # this for example in some std::transform expressions.
 # This is a known issue: https://bugreports.qt.io/browse/QTBUG-47066
 # Alternatively, one would always have to remember to force the lambdas to
 # return a QString instead of QStringBuilder, but that's just too easy to
 # forget and, unfortunately, the compiler doesn't issue a warning if one forgets
 # this. So, it's just too dangerous.
 # One can still use QStringBuilder explicitly with the operator% if necessary.
 remove_definitions(-DQT_USE_FAST_OPERATOR_PLUS)
 remove_definitions(-DQT_USE_QSTRINGBUILDER)
 
 kde_enable_exceptions()
 option(USE_UNITY_CMAKE_SUPPORT "Use UNITY cmake support (speedup compile time)" OFF)
 
 set(COMPILE_WITH_UNITY_CMAKE_SUPPORT OFF)
 if (USE_UNITY_CMAKE_SUPPORT)
     set(COMPILE_WITH_UNITY_CMAKE_SUPPORT ON)
 endif()
 
 
 add_subdirectory(pics)
 add_subdirectory(src)
 
 if(BUILD_TESTING)
     add_subdirectory(tests)
     add_subdirectory(autotests)
 endif()
 
 ecm_qt_install_logging_categories(
         EXPORT KLEOPATRA
         FILE kleopatra.categories
         DESTINATION ${KDE_INSTALL_LOGGINGCATEGORIESDIR}
         )
 
 ki18n_install(po)
 if(KF${KF_MAJOR_VERSION}DocTools_FOUND)
     kdoctools_install(po)
     add_subdirectory(doc)
 endif()
 feature_summary(WHAT ALL FATAL_ON_MISSING_REQUIRED_PACKAGES)
 
 # add clang-format target for all our real source files
 file(GLOB_RECURSE ALL_CLANG_FORMAT_SOURCE_FILES *.cpp *.h *.c)
 kde_clang_format(${ALL_CLANG_FORMAT_SOURCE_FILES})
 kde_configure_git_pre_commit_hook(CHECKS CLANG_FORMAT)
 
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index acc24d169..92280a365 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -1,625 +1,627 @@
 # SPDX-FileCopyrightText: none
 # SPDX-License-Identifier: BSD-3-Clause
 add_subdirectory(icons)
 add_subdirectory(mimetypes)
 
 include_directories(${CMAKE_CURRENT_BINARY_DIR})
 include_directories(${CMAKE_CURRENT_SOURCE_DIR})
 
 if (NOT DISABLE_KWATCHGNUPG)
     add_subdirectory(kwatchgnupg)
 endif()
 add_subdirectory(libkleopatraclient)
 add_subdirectory(conf)
 add_subdirectory(kconf_update)
 
 if(WIN32)
   set(_kleopatra_extra_uiserver_SRCS uiserver/uiserver_win.cpp)
   set(_kleopatra_extra_SRCS
       selftest/registrycheck.cpp selftest/registrycheck.h
       utils/gnupg-registry.c
       utils/userinfo_win.cpp
       utils/windowsprocessdevice.cpp utils/windowsprocessdevice.h
       versioninfo.rc kleopatra.w32-manifest
   )
 else()
   set(_kleopatra_extra_uiserver_SRCS uiserver/uiserver_unix.cpp)
   set(_kleopatra_extra_SRCS)
 endif()
 
 set(_kleopatra_uiserver_SRCS
     ${_kleopatra_extra_uiserver_SRCS}
 
     selftest/uiservercheck.cpp selftest/uiservercheck.h
     uiserver/assuanserverconnection.cpp uiserver/assuanserverconnection.h
     uiserver/createchecksumscommand.cpp uiserver/createchecksumscommand.h
     uiserver/decryptverifycommandemailbase.cpp uiserver/decryptverifycommandemailbase.h
     uiserver/decryptverifycommandfilesbase.cpp uiserver/decryptverifycommandfilesbase.h
     uiserver/echocommand.cpp uiserver/echocommand.h
     uiserver/encryptcommand.cpp uiserver/encryptcommand.h
     uiserver/importfilescommand.cpp uiserver/importfilescommand.h
     uiserver/prepencryptcommand.cpp uiserver/prepencryptcommand.h
     uiserver/prepsigncommand.cpp uiserver/prepsigncommand.h
     uiserver/selectcertificatecommand.cpp
     uiserver/sessiondata.cpp uiserver/sessiondata.h
     uiserver/signcommand.cpp uiserver/signcommand.h
     uiserver/signencryptfilescommand.cpp
     uiserver/uiserver.cpp
     uiserver/verifychecksumscommand.cpp uiserver/verifychecksumscommand.h
   )
 
 set(_kleopatra_uiserver_extra_libs LibAssuan::LibAssuan LibGpgError::LibGpgError)
 
 if(HAVE_GPG_ERR_SOURCE_KLEO)
   add_definitions(-DGPG_ERR_SOURCE_DEFAULT=GPG_ERR_SOURCE_KLEO)
   add_definitions(-DGPGMEPP_ERR_SOURCE_DEFAULT=GPG_ERR_SOURCE_KLEO)
 else()
   add_definitions(-DGPG_ERR_SOURCE_DEFAULT=GPG_ERR_SOURCE_USER_1)
   add_definitions(-DGPGMEPP_ERR_SOURCE_DEFAULT=GPG_ERR_SOURCE_USER_1)
 endif()
 
 if(KPim${KF_MAJOR_VERSION}IdentityManagement_FOUND AND KPim${KF_MAJOR_VERSION}MailTransport_FOUND AND KPim${KF_MAJOR_VERSION}AkonadiMime_FOUND)
   set(_kleopatra_mail_libs
       KPim${KF_MAJOR_VERSION}::IdentityManagement # Export OpenPGP keys using WKS
       KPim${KF_MAJOR_VERSION}::MailTransport
       KPim${KF_MAJOR_VERSION}::AkonadiMime
   )
   add_definitions(-DMAILAKONADI_ENABLED)
 endif()
 
 ki18n_wrap_ui(_kleopatra_uiserver_SRCS crypto/gui/signingcertificateselectionwidget.ui)
 
 set(_kleopatra_SRCS
   ${_kleopatra_extra_SRCS}
 
   accessibility/accessiblelink.cpp
   accessibility/accessiblelink_p.h
   accessibility/accessiblerichtextlabel.cpp
   accessibility/accessiblerichtextlabel_p.h
   accessibility/accessiblevaluelabel.cpp
   accessibility/accessiblevaluelabel_p.h
   accessibility/accessiblewidgetfactory.cpp
   accessibility/accessiblewidgetfactory.h
   commands/adduseridcommand.cpp
   commands/adduseridcommand.h
   commands/authenticatepivcardapplicationcommand.cpp
   commands/authenticatepivcardapplicationcommand.h
   commands/cardcommand.cpp
   commands/cardcommand.h
   commands/certificatetopivcardcommand.cpp
   commands/certificatetopivcardcommand.h
   commands/certifycertificatecommand.cpp
   commands/certifycertificatecommand.h
+  commands/certifygroupcommand.cpp
+  commands/certifygroupcommand.h
   commands/changeexpirycommand.cpp
   commands/changeexpirycommand.h
   commands/changeownertrustcommand.cpp
   commands/changeownertrustcommand.h
   commands/changepassphrasecommand.cpp
   commands/changepassphrasecommand.h
   commands/changepincommand.cpp
   commands/changepincommand.h
   commands/changeroottrustcommand.cpp
   commands/changeroottrustcommand.h
   commands/checksumcreatefilescommand.cpp
   commands/checksumcreatefilescommand.h
   commands/checksumverifyfilescommand.cpp
   commands/checksumverifyfilescommand.h
   commands/clearcrlcachecommand.cpp
   commands/clearcrlcachecommand.h
   commands/command.cpp
   commands/command.h
   commands/createcsrforcardkeycommand.cpp
   commands/createcsrforcardkeycommand.h
   commands/createopenpgpkeyfromcardkeyscommand.cpp
   commands/createopenpgpkeyfromcardkeyscommand.h
   commands/decryptverifyclipboardcommand.cpp
   commands/decryptverifyclipboardcommand.h
   commands/decryptverifyfilescommand.cpp
   commands/decryptverifyfilescommand.h
   commands/deletecertificatescommand.cpp
   commands/deletecertificatescommand.h
   commands/detailscommand.cpp
   commands/detailscommand.h
   commands/dumpcertificatecommand.cpp
   commands/dumpcertificatecommand.h
   commands/dumpcrlcachecommand.cpp
   commands/dumpcrlcachecommand.h
   commands/encryptclipboardcommand.cpp
   commands/encryptclipboardcommand.h
   commands/exportcertificatecommand.cpp
   commands/exportcertificatecommand.h
   commands/exportgroupscommand.cpp
   commands/exportgroupscommand.h
   commands/exportopenpgpcertstoservercommand.cpp
   commands/exportopenpgpcertstoservercommand.h
   commands/exportopenpgpcerttoprovidercommand.cpp
   commands/exportopenpgpcerttoprovidercommand.h
   commands/exportpaperkeycommand.cpp
   commands/exportpaperkeycommand.h
   commands/exportsecretkeycommand.cpp
   commands/exportsecretkeycommand.h
   commands/exportsecretkeycommand_old.cpp
   commands/exportsecretkeycommand_old.h
   commands/exportsecretsubkeycommand.cpp
   commands/exportsecretsubkeycommand.h
   commands/genrevokecommand.cpp
   commands/genrevokecommand.h
   commands/gnupgprocesscommand.cpp
   commands/gnupgprocesscommand.h
   commands/importcertificatefromclipboardcommand.cpp
   commands/importcertificatefromclipboardcommand.h
   commands/importcertificatefromdatacommand.cpp
   commands/importcertificatefromdatacommand.h
   commands/importcertificatefromfilecommand.cpp
   commands/importcertificatefromfilecommand.h
   commands/importcertificatefromkeyservercommand.cpp
   commands/importcertificatefromkeyservercommand.h
   commands/importcertificatefrompivcardcommand.cpp
   commands/importcertificatefrompivcardcommand.h
   commands/importcertificatescommand.cpp
   commands/importcertificatescommand.h
   commands/importcrlcommand.cpp
   commands/importcrlcommand.h
   commands/importpaperkeycommand.cpp
   commands/importpaperkeycommand.h
   commands/keytocardcommand.cpp
   commands/keytocardcommand.h
   commands/learncardkeyscommand.cpp
   commands/learncardkeyscommand.h
   commands/lookupcertificatescommand.cpp
   commands/lookupcertificatescommand.h
   commands/newcertificatesigningrequestcommand.cpp
   commands/newcertificatesigningrequestcommand.h
   commands/newopenpgpcertificatecommand.cpp
   commands/newopenpgpcertificatecommand.h
   commands/openpgpgeneratecardkeycommand.cpp
   commands/openpgpgeneratecardkeycommand.h
   commands/pivgeneratecardkeycommand.cpp
   commands/pivgeneratecardkeycommand.h
   commands/refreshcertificatecommand.cpp
   commands/refreshcertificatecommand.h
   commands/refreshopenpgpcertscommand.cpp
   commands/refreshopenpgpcertscommand.h
   commands/refreshx509certscommand.cpp
   commands/refreshx509certscommand.h
   commands/reloadkeyscommand.cpp
   commands/reloadkeyscommand.h
   commands/revokecertificationcommand.cpp
   commands/revokecertificationcommand.h
   commands/revokekeycommand.cpp
   commands/revokekeycommand.h
   commands/revokeuseridcommand.cpp
   commands/revokeuseridcommand.h
   commands/selftestcommand.cpp
   commands/selftestcommand.h
   commands/setinitialpincommand.cpp
   commands/setinitialpincommand.h
   commands/setpivcardapplicationadministrationkeycommand.cpp
   commands/setpivcardapplicationadministrationkeycommand.h
   commands/setprimaryuseridcommand.cpp
   commands/setprimaryuseridcommand.h
   commands/signclipboardcommand.cpp
   commands/signclipboardcommand.h
   commands/signencryptfilescommand.cpp
   commands/signencryptfilescommand.h
   commands/signencryptfoldercommand.cpp
   commands/signencryptfoldercommand.h
   commands/viewemailfilescommand.cpp
   commands/viewemailfilescommand.h
   conf/configuredialog.cpp
   conf/configuredialog.h
   conf/groupsconfigdialog.cpp
   conf/groupsconfigdialog.h
   conf/groupsconfigpage.cpp
   conf/groupsconfigpage.h
   conf/groupsconfigwidget.cpp
   conf/groupsconfigwidget.h
   crypto/autodecryptverifyfilescontroller.cpp
   crypto/autodecryptverifyfilescontroller.h
   crypto/certificateresolver.cpp
   crypto/certificateresolver.h
   crypto/checksumsutils_p.cpp
   crypto/checksumsutils_p.h
   crypto/controller.cpp
   crypto/controller.h
   crypto/createchecksumscontroller.cpp
   crypto/createchecksumscontroller.h
   crypto/decryptverifyemailcontroller.cpp
   crypto/decryptverifyemailcontroller.h
   crypto/decryptverifyfilescontroller.cpp
   crypto/decryptverifyfilescontroller.h
   crypto/decryptverifytask.cpp
   crypto/decryptverifytask.h
   crypto/encryptemailcontroller.cpp
   crypto/encryptemailcontroller.h
   crypto/encryptemailtask.cpp
   crypto/encryptemailtask.h
   crypto/gui/certificatelineedit.cpp
   crypto/gui/certificatelineedit.h
   crypto/gui/certificateselectionline.cpp
   crypto/gui/certificateselectionline.h
   crypto/gui/decryptverifyfilesdialog.cpp
   crypto/gui/decryptverifyfilesdialog.h
   crypto/gui/decryptverifyfileswizard.cpp
   crypto/gui/decryptverifyfileswizard.h
   crypto/gui/decryptverifyoperationwidget.cpp
   crypto/gui/decryptverifyoperationwidget.h
   crypto/gui/encryptemailwizard.cpp
   crypto/gui/encryptemailwizard.h
   crypto/gui/newresultpage.cpp
   crypto/gui/newresultpage.h
   crypto/gui/objectspage.cpp
   crypto/gui/objectspage.h
   crypto/gui/resolverecipientspage.cpp
   crypto/gui/resolverecipientspage.h
   crypto/gui/resultitemwidget.cpp
   crypto/gui/resultitemwidget.h
   crypto/gui/resultlistwidget.cpp
   crypto/gui/resultlistwidget.h
   crypto/gui/resultpage.cpp
   crypto/gui/resultpage.h
   crypto/gui/signemailwizard.cpp
   crypto/gui/signemailwizard.h
   crypto/gui/signencryptemailconflictdialog.cpp
   crypto/gui/signencryptemailconflictdialog.h
   crypto/gui/signencryptfileswizard.cpp
   crypto/gui/signencryptfileswizard.h
   crypto/gui/signencryptwidget.cpp
   crypto/gui/signencryptwidget.h
   crypto/gui/signencryptwizard.cpp
   crypto/gui/signencryptwizard.h
   crypto/gui/signerresolvepage.cpp
   crypto/gui/signerresolvepage.h
   crypto/gui/signingcertificateselectiondialog.cpp
   crypto/gui/signingcertificateselectiondialog.h
   crypto/gui/signingcertificateselectionwidget.cpp
   crypto/gui/signingcertificateselectionwidget.h
   crypto/gui/unknownrecipientwidget.cpp
   crypto/gui/unknownrecipientwidget.h
   crypto/gui/verifychecksumsdialog.cpp
   crypto/gui/verifychecksumsdialog.h
   crypto/gui/wizard.cpp
   crypto/gui/wizard.h
   crypto/gui/wizardpage.cpp
   crypto/gui/wizardpage.h
   crypto/newsignencryptemailcontroller.cpp
   crypto/newsignencryptemailcontroller.h
   crypto/recipient.cpp
   crypto/recipient.h
   crypto/sender.cpp
   crypto/sender.h
   crypto/signemailcontroller.cpp
   crypto/signemailcontroller.h
   crypto/signemailtask.cpp
   crypto/signemailtask.h
   crypto/signencryptfilescontroller.cpp
   crypto/signencryptfilescontroller.h
   crypto/signencrypttask.cpp
   crypto/signencrypttask.h
   crypto/task.cpp
   crypto/task.h
   crypto/taskcollection.cpp
   crypto/taskcollection.h
   crypto/verifychecksumscontroller.cpp
   crypto/verifychecksumscontroller.h
   dialogs/adduseriddialog.cpp
   dialogs/adduseriddialog.h
   dialogs/certificatedetailsdialog.cpp
   dialogs/certificatedetailsdialog.h
   dialogs/certificatedetailsinputwidget.cpp
   dialogs/certificatedetailsinputwidget.h
   dialogs/certificatedetailswidget.cpp
   dialogs/certificatedetailswidget.h
   dialogs/certificateselectiondialog.cpp
   dialogs/certificateselectiondialog.h
   dialogs/certifycertificatedialog.cpp
   dialogs/certifycertificatedialog.h
   dialogs/certifywidget.cpp
   dialogs/certifywidget.h
   dialogs/createcsrforcardkeydialog.cpp
   dialogs/createcsrforcardkeydialog.h
   dialogs/deletecertificatesdialog.cpp
   dialogs/deletecertificatesdialog.h
   dialogs/editgroupdialog.cpp
   dialogs/editgroupdialog.h
   dialogs/expirydialog.cpp
   dialogs/expirydialog.h
   dialogs/exportdialog.cpp
   dialogs/exportdialog.h
   dialogs/gencardkeydialog.cpp
   dialogs/gencardkeydialog.h
   dialogs/groupdetailsdialog.cpp
   dialogs/groupdetailsdialog.h
   dialogs/lookupcertificatesdialog.cpp
   dialogs/lookupcertificatesdialog.h
   dialogs/nameandemailwidget.cpp
   dialogs/nameandemailwidget.h
   dialogs/newopenpgpcertificatedetailsdialog.cpp
   dialogs/newopenpgpcertificatedetailsdialog.h
   dialogs/pivcardapplicationadministrationkeyinputdialog.cpp
   dialogs/pivcardapplicationadministrationkeyinputdialog.h
   dialogs/revokekeydialog.cpp
   dialogs/revokekeydialog.h
   dialogs/selftestdialog.cpp
   dialogs/selftestdialog.h
   dialogs/setinitialpindialog.cpp
   dialogs/setinitialpindialog.h
   dialogs/subkeyswidget.cpp
   dialogs/subkeyswidget.h
   dialogs/trustchainwidget.cpp
   dialogs/trustchainwidget.h
   dialogs/updatenotification.cpp
   dialogs/updatenotification.h
   dialogs/weboftrustdialog.cpp
   dialogs/weboftrustdialog.h
   dialogs/weboftrustwidget.cpp
   dialogs/weboftrustwidget.h
   interfaces/anchorprovider.h
   interfaces/focusfirstchild.h
   newcertificatewizard/advancedsettingsdialog.cpp
   newcertificatewizard/advancedsettingsdialog_p.h
   newcertificatewizard/enterdetailspage.cpp
   newcertificatewizard/enterdetailspage_p.h
   newcertificatewizard/keyalgo.cpp
   newcertificatewizard/keyalgo_p.h
   newcertificatewizard/keycreationpage.cpp
   newcertificatewizard/keycreationpage_p.h
   newcertificatewizard/listwidget.cpp
   newcertificatewizard/listwidget.h
   newcertificatewizard/newcertificatewizard.cpp
   newcertificatewizard/newcertificatewizard.h
   newcertificatewizard/resultpage.cpp
   newcertificatewizard/resultpage_p.h
   newcertificatewizard/wizardpage.cpp
   newcertificatewizard/wizardpage_p.h
   selftest/compliancecheck.cpp
   selftest/compliancecheck.h
   selftest/enginecheck.cpp
   selftest/enginecheck.h
   selftest/gpgagentcheck.cpp
   selftest/gpgagentcheck.h
   selftest/gpgconfcheck.cpp
   selftest/gpgconfcheck.h
   selftest/libkleopatrarccheck.cpp
   selftest/libkleopatrarccheck.h
   selftest/selftest.cpp
   selftest/selftest.h
   smartcard/algorithminfo.h
   smartcard/card.cpp
   smartcard/card.h
   smartcard/deviceinfowatcher.cpp
   smartcard/deviceinfowatcher.h
   smartcard/keypairinfo.cpp
   smartcard/keypairinfo.h
   smartcard/netkeycard.cpp
   smartcard/netkeycard.h
   smartcard/openpgpcard.cpp
   smartcard/openpgpcard.h
   smartcard/p15card.cpp
   smartcard/p15card.h
   smartcard/pivcard.cpp
   smartcard/pivcard.h
   smartcard/readerstatus.cpp
   smartcard/readerstatus.h
   smartcard/utils.cpp
   smartcard/utils.h
   utils/accessibility.cpp
   utils/accessibility.h
   utils/action_data.cpp
   utils/action_data.h
   utils/applicationstate.cpp
   utils/applicationstate.h
   utils/archivedefinition.cpp
   utils/archivedefinition.h
   utils/clipboardmenu.cpp
   utils/clipboardmenu.h
   utils/debug-helpers.cpp
   utils/debug-helpers.h
   utils/dragqueen.cpp
   utils/dragqueen.h
   utils/email.cpp
   utils/email.h
   utils/emptypassphraseprovider.cpp
   utils/emptypassphraseprovider.h
   utils/expiration.cpp
   utils/expiration.h
   utils/filedialog.cpp
   utils/filedialog.h
   utils/gui-helper.cpp
   utils/gui-helper.h
   utils/headerview.cpp
   utils/headerview.h
   utils/input.cpp
   utils/input.h
   utils/iodevicelogger.cpp
   utils/iodevicelogger.h
   utils/kdpipeiodevice.cpp
   utils/kdpipeiodevice.h
   utils/keyparameters.cpp
   utils/keyparameters.h
   utils/keys.cpp
   utils/keys.h
   utils/kuniqueservice.cpp
   utils/kuniqueservice.h
   utils/log.cpp
   utils/log.h
   utils/memory-helpers.h
   utils/multivalidator.cpp
   utils/multivalidator.h
   utils/output.cpp
   utils/output.h
   utils/overwritedialog.cpp
   utils/overwritedialog.h
   utils/path-helper.cpp
   utils/path-helper.h
   utils/scrollarea.cpp
   utils/scrollarea.h
   utils/systemtrayicon.cpp
   utils/systemtrayicon.h
   utils/tags.cpp
   utils/tags.h
   utils/types.cpp
   utils/types.h
   utils/userinfo.cpp
   utils/userinfo.h
   utils/validation.cpp
   utils/validation.h
   utils/writecertassuantransaction.cpp
   utils/writecertassuantransaction.h
   utils/wsastarter.cpp
   utils/wsastarter.h
   view/anchorcache.cpp
   view/anchorcache_p.h
   view/errorlabel.cpp
   view/errorlabel.h
   view/formtextinput.cpp
   view/formtextinput.h
   view/htmllabel.cpp
   view/htmllabel.h
   view/infofield.cpp
   view/infofield.h
   view/keycacheoverlay.cpp
   view/keycacheoverlay.h
   view/keylistcontroller.cpp
   view/keylistcontroller.h
   view/keytreeview.cpp
   view/keytreeview.h
   view/netkeywidget.cpp
   view/netkeywidget.h
   view/nullpinwidget.cpp
   view/nullpinwidget.h
   view/openpgpkeycardwidget.cpp
   view/openpgpkeycardwidget.h
   view/p15cardwidget.cpp
   view/p15cardwidget.h
   view/padwidget.cpp
   view/padwidget.h
   view/pgpcardwidget.cpp
   view/pgpcardwidget.h
   view/pivcardwidget.cpp
   view/pivcardwidget.h
   view/searchbar.cpp
   view/searchbar.h
   view/smartcardwidget.cpp
   view/smartcardwidget.h
   view/tabwidget.cpp
   view/tabwidget.h
   view/urllabel.cpp
   view/urllabel.h
   view/waitwidget.cpp
   view/waitwidget.h
   view/welcomewidget.cpp
   view/welcomewidget.h
 
   aboutdata.cpp
   aboutdata.h
   kleopatra.qrc
   kleopatraapplication.cpp
   kleopatraapplication.h
   main.cpp
   mainwindow.cpp
   mainwindow.h
   systrayicon.cpp
   systrayicon.h
 )
 
 if(WIN32)
   configure_file (versioninfo.rc.in versioninfo.rc)
   set(_kleopatra_SRCS ${CMAKE_CURRENT_BINARY_DIR}/versioninfo.rc ${_kleopatra_SRCS})
   configure_file (kleopatra.w32-manifest.in kleopatra.w32-manifest)
   set(_kleopatra_SRCS ${CMAKE_CURRENT_BINARY_DIR}/kleopatra.w32-manifest ${_kleopatra_SRCS})
 endif()
 
 set (_kleopatra_SRCS conf/kleopageconfigdialog.cpp conf/kleopageconfigdialog.h ${_kleopatra_SRCS})
 
 ecm_qt_declare_logging_category(_kleopatra_SRCS HEADER kleopatra_debug.h IDENTIFIER KLEOPATRA_LOG CATEGORY_NAME org.kde.pim.kleopatra
         DESCRIPTION "kleopatra (kleopatra)"
         OLD_CATEGORY_NAMES log_kleopatra
         EXPORT KLEOPATRA
     )
 
 
 if(KLEO_MODEL_TEST)
   add_definitions(-DKLEO_MODEL_TEST)
   set(_kleopatra_SRCS ${_kleopatra_SRCS} models/modeltest.cpp)
 endif()
 
 ki18n_wrap_ui(_kleopatra_SRCS
   dialogs/setinitialpindialog.ui
   dialogs/trustchainwidget.ui
   newcertificatewizard/listwidget.ui
 )
 
 kconfig_add_kcfg_files(_kleopatra_SRCS
   kcfg/emailoperationspreferences.kcfgc
   kcfg/fileoperationspreferences.kcfgc
   kcfg/settings.kcfgc
   kcfg/smimevalidationpreferences.kcfgc
   kcfg/tagspreferences.kcfgc
   kcfg/tooltippreferences.kcfgc
 )
 
 file(GLOB ICONS_SRCS "${CMAKE_CURRENT_SOURCE_DIR}/icons/*-apps-kleopatra.png")
 ecm_add_app_icon(_kleopatra_SRCS ICONS ${ICONS_SRCS})
 
 add_executable(kleopatra_bin ${_kleopatra_SRCS} ${_kleopatra_uiserver_SRCS})
 
 # For the ConfigureDialog & KCMs
 target_link_libraries(kleopatra_bin kcm_kleopatra_static)
 
 #if (COMPILE_WITH_UNITY_CMAKE_SUPPORT)
 #    set_target_properties(kleopatra_bin PROPERTIES UNITY_BUILD ON)
 #endif()
 set_target_properties(kleopatra_bin PROPERTIES OUTPUT_NAME kleopatra)
 
 if (WIN32)
   set(_kleopatra_platform_libs "secur32")
 endif ()
 
 target_link_libraries(kleopatra_bin
   Gpgmepp
   KPim${KF_MAJOR_VERSION}::Libkleo
   KPim${KF_MAJOR_VERSION}::Mime
   KPim${KF_MAJOR_VERSION}::MimeTreeParserWidgets
   KF${KF_MAJOR_VERSION}::Codecs
   KF${KF_MAJOR_VERSION}::CoreAddons
   KF${KF_MAJOR_VERSION}::Crash
   KF${KF_MAJOR_VERSION}::I18n
   KF${KF_MAJOR_VERSION}::IconThemes
   KF${KF_MAJOR_VERSION}::ItemModels
   KF${KF_MAJOR_VERSION}::KIOCore
   KF${KF_MAJOR_VERSION}::KIOWidgets
   KF${KF_MAJOR_VERSION}::WindowSystem
   KF${KF_MAJOR_VERSION}::XmlGui
   Qt::Network
   Qt::PrintSupport # Printing secret keys
   kleopatraclientcore
   ${_kleopatra_extra_libs}
   ${_kleopatra_mail_libs}
   ${_kleopatra_uiserver_extra_libs}
   ${_kleopatra_dbusaddons_libs}
   ${_kleopatra_platform_libs}
 )
 
 if (QT_MAJOR_VERSION STREQUAL "6")
     target_link_libraries(kleopatra_bin Qt6::Core5Compat)
     target_link_libraries(kleopatra_bin QGpgmeQt6)
 else()
     target_link_libraries(kleopatra_bin QGpgme)
 endif()
 
 install(TARGETS kleopatra_bin ${KDE_INSTALL_TARGETS_DEFAULT_ARGS})
 
 install(
   PROGRAMS data/org.kde.kleopatra.desktop data/kleopatra_import.desktop
   DESTINATION ${KDE_INSTALL_APPDIR}
 )
 install(FILES data/org.kde.kleopatra.appdata.xml DESTINATION ${KDE_INSTALL_METAINFODIR})
 install(FILES data/kleopatra-mime.xml DESTINATION ${KDE_INSTALL_MIMEDIR})
 install(
   PROGRAMS data/kleopatra_signencryptfiles.desktop
         data/kleopatra_signencryptfolders.desktop
         data/kleopatra_decryptverifyfiles.desktop
         data/kleopatra_decryptverifyfolders.desktop
   DESTINATION ${KDE_INSTALL_DATADIR}/kio/servicemenus
 )
diff --git a/src/commands/certifygroupcommand.cpp b/src/commands/certifygroupcommand.cpp
new file mode 100644
index 000000000..6e31ff99c
--- /dev/null
+++ b/src/commands/certifygroupcommand.cpp
@@ -0,0 +1,299 @@
+/*
+    commands/certifygroupcommand.cpp
+
+    This file is part of Kleopatra, the KDE keymanager
+    SPDX-FileCopyrightText: 2023 g10 Code GmbH
+    SPDX-FileContributor: Ingo Klöcker <dev@ingo-kloecker.de>
+
+    SPDX-License-Identifier: GPL-2.0-or-later
+*/
+
+#include "certifygroupcommand.h"
+#include "command_p.h"
+
+#include <commands/exportopenpgpcertstoservercommand.h>
+#include <dialogs/certifycertificatedialog.h>
+#include <utils/keys.h>
+#include <utils/tags.h>
+
+#include <Libkleo/Algorithm>
+#include <Libkleo/Formatting>
+#include <Libkleo/KeyGroup>
+#include <Libkleo/KeyHelpers>
+
+#include <QGpgME/Protocol>
+#include <QGpgME/SignKeyJob>
+
+#include <QDate>
+
+#include <gpgme++/key.h>
+
+using namespace Kleo;
+using namespace Kleo::Commands;
+using namespace GpgME;
+
+namespace
+{
+struct CertificationResultData {
+    std::vector<UserID> userIds;
+    GpgME::Error error;
+};
+}
+
+class CertifyGroupCommand::Private : public Command::Private
+{
+    friend class ::Kleo::CertifyGroupCommand;
+    CertifyGroupCommand *q_func() const
+    {
+        return static_cast<CertifyGroupCommand *>(q);
+    }
+
+public:
+    explicit Private(CertifyGroupCommand *qq);
+    ~Private() override;
+
+    void start();
+
+private:
+    void showDialog();
+    void certifyCertificates();
+    void startNextCertification();
+    void createJob();
+    void slotResult(const Error &err);
+    void wrapUp();
+
+private:
+    KeyGroup group;
+    std::vector<Key> certificates;
+    QPointer<CertifyCertificateDialog> dialog;
+    std::vector<UserID> userIdsToCertify;
+    struct {
+        Key certificationKey;
+        QDate expirationDate;
+        QString tags;
+        bool exportable = false;
+        bool sendToServer = false;
+    } certificationOptions;
+    struct {
+        std::vector<UserID> userIds;
+    } jobData;
+    QPointer<QGpgME::SignKeyJob> job;
+    std::vector<CertificationResultData> results;
+};
+
+CertifyGroupCommand::Private *CertifyGroupCommand::d_func()
+{
+    return static_cast<Private *>(d.get());
+}
+const CertifyGroupCommand::Private *CertifyGroupCommand::d_func() const
+{
+    return static_cast<const Private *>(d.get());
+}
+
+#define d d_func()
+#define q q_func()
+
+CertifyGroupCommand::Private::Private(CertifyGroupCommand *qq)
+    : Command::Private(qq)
+{
+}
+
+CertifyGroupCommand::Private::~Private() = default;
+
+void CertifyGroupCommand::Private::start()
+{
+    if (!group.isNull()) {
+        const auto &groupKeys = group.keys();
+        certificates = std::vector<GpgME::Key>(groupKeys.begin(), groupKeys.end());
+    }
+    if (certificates.empty()) {
+        finished();
+        return;
+    }
+    if (!allKeysHaveProtocol(certificates, GpgME::OpenPGP)) {
+        const auto title = i18nc("@title:window", "Group Cannot Be Certified");
+        const auto message = i18nc("@info", "This group contains S/MIME certificates which cannot be certified.");
+        information(message, title);
+        finished();
+        return;
+    }
+
+    showDialog();
+}
+
+void CertifyGroupCommand::Private::showDialog()
+{
+    dialog = new CertifyCertificateDialog;
+    dialog->setAttribute(Qt::WA_DeleteOnClose);
+    applyWindowID(dialog);
+
+    connect(dialog, &QDialog::accepted, q, [this]() {
+        certifyCertificates();
+    });
+    connect(dialog, &QDialog::rejected, q, [this]() {
+        canceled();
+    });
+
+    if (!group.isNull()) {
+        dialog->setGroupName(group.name());
+    }
+    dialog->setCertificatesToCertify(certificates);
+    dialog->show();
+}
+
+void CertifyGroupCommand::Private::certifyCertificates()
+{
+    userIdsToCertify = dialog->selectedUserIDs();
+    if (userIdsToCertify.empty()) {
+        canceled();
+        return;
+    }
+    certificationOptions.certificationKey = dialog->selectedSecretKey();
+    certificationOptions.expirationDate = dialog->expirationDate();
+    certificationOptions.tags = dialog->tags();
+    certificationOptions.exportable = dialog->exportableCertificationSelected();
+    certificationOptions.sendToServer = dialog->sendToServer();
+
+    startNextCertification();
+}
+
+void CertifyGroupCommand::Private::startNextCertification()
+{
+    Q_ASSERT(!userIdsToCertify.empty());
+
+    const auto nextKey = userIdsToCertify.front().parent();
+    // for now we only deal with primary user IDs
+    jobData.userIds = {userIdsToCertify.front()};
+    userIdsToCertify.erase(userIdsToCertify.begin());
+    const std::vector<unsigned int> userIdIndexes = {0};
+
+    createJob();
+    job->setUserIDsToSign(userIdIndexes);
+    if (const Error err = job->start(nextKey)) {
+        QMetaObject::invokeMethod(
+            q,
+            [this, err]() {
+                slotResult(err);
+            },
+            Qt::QueuedConnection);
+    }
+}
+
+void CertifyGroupCommand::Private::createJob()
+{
+    Q_ASSERT(!job);
+
+    std::unique_ptr<QGpgME::SignKeyJob> newJob{QGpgME::openpgp()->signKeyJob()};
+    newJob->setDupeOk(true);
+    newJob->setSigningKey(certificationOptions.certificationKey);
+    newJob->setExportable(certificationOptions.exportable);
+    if (!certificationOptions.tags.isEmpty()) {
+        // do not set an empty remark to avoid an empty signature notation (GnuPG bug T5142)
+        newJob->setRemark(certificationOptions.tags);
+    }
+    if (!certificationOptions.expirationDate.isNull()) {
+        newJob->setExpirationDate(certificationOptions.expirationDate);
+    }
+    connect(newJob.get(), &QGpgME::SignKeyJob::result, q, [this](const GpgME::Error &result) {
+        slotResult(result);
+    });
+
+    job = newJob.release();
+}
+
+void CertifyGroupCommand::Private::slotResult(const Error &err)
+{
+    results.push_back({
+        jobData.userIds,
+        err,
+    });
+
+    if (err.isCanceled()) {
+        finished();
+        return;
+    }
+    if (err) {
+        // for now we only deal with primary user IDs
+        Q_ASSERT(jobData.userIds.size() == 1);
+        const Key key = jobData.userIds.front().parent();
+        const QString message = i18nc("@info", "<p>Certifying the certificate <b>%1</b> failed.</p>", Formatting::formatForComboBox(key))
+            + xi18nc("@info", "<para>Error: <message>%1</message></para>", Formatting::errorAsString(err));
+        error(message);
+    }
+
+    if (!userIdsToCertify.empty()) {
+        job.clear();
+        jobData.userIds.clear();
+        startNextCertification();
+        return;
+    }
+
+    wrapUp();
+}
+
+static QString resultSummary(int successCount, int totalCount)
+{
+    if (successCount == totalCount) {
+        return i18nc("@info", "All certificates were certified successfully.");
+    }
+    if (successCount == 0) {
+        return i18nc("@info", "The certification of all certificates failed.");
+    }
+    return i18ncp("@info", //
+                  "1 of %2 certificates was certified successfully.",
+                  "%1 of %2 certificates were certified successfully.",
+                  successCount,
+                  totalCount);
+}
+
+void CertifyGroupCommand::Private::wrapUp()
+{
+    Q_ASSERT(userIdsToCertify.empty());
+
+    const int successCount = Kleo::count_if(results, [](const auto &result) {
+        return !result.error;
+    });
+    if (successCount == 0) {
+        // there's no point in sending anything to the server
+        certificationOptions.sendToServer = false;
+    }
+    const QString message = QLatin1String{"<p>"} + resultSummary(successCount, results.size()) + QLatin1String{"</p>"};
+    if (successCount > 0) {
+        information(message, i18nc("@title:window", "Certification Completed"));
+    } else {
+        error(message);
+    }
+
+    if (!certificationOptions.tags.isEmpty()) {
+        Tags::enableTags();
+    }
+    finished();
+}
+
+CertifyGroupCommand::CertifyGroupCommand(const KeyGroup &group)
+    : Command{new Private{this}}
+{
+    d->group = group;
+}
+
+CertifyGroupCommand::~CertifyGroupCommand() = default;
+
+void CertifyGroupCommand::doStart()
+{
+    d->start();
+}
+
+void CertifyGroupCommand::doCancel()
+{
+    if (d->dialog) {
+        d->dialog->close();
+    }
+    if (d->job) {
+        d->job->slotCancel();
+    }
+}
+
+#undef d
+#undef q
+
+#include "moc_certifygroupcommand.cpp"
diff --git a/src/commands/certifygroupcommand.h b/src/commands/certifygroupcommand.h
new file mode 100644
index 000000000..8e8377940
--- /dev/null
+++ b/src/commands/certifygroupcommand.h
@@ -0,0 +1,41 @@
+/*
+    commands/certifygroupcommand.h
+
+    This file is part of Kleopatra, the KDE keymanager
+    SPDX-FileCopyrightText: 2023 g10 Code GmbH
+    SPDX-FileContributor: Ingo Klöcker <dev@ingo-kloecker.de>
+
+    SPDX-License-Identifier: GPL-2.0-or-later
+*/
+
+#pragma once
+
+#include "command.h"
+
+namespace Kleo
+{
+class KeyGroup;
+
+class CertifyGroupCommand : public Command
+{
+    Q_OBJECT
+public:
+    explicit CertifyGroupCommand(const KeyGroup &group);
+    ~CertifyGroupCommand() override;
+
+    /* reimp */ static Restrictions restrictions()
+    {
+        return MustBeOpenPGP | MustBeValid;
+    }
+
+private:
+    void doStart() override;
+    void doCancel() override;
+
+private:
+    class Private;
+    inline Private *d_func();
+    inline const Private *d_func() const;
+};
+
+}
diff --git a/src/dialogs/certifycertificatedialog.cpp b/src/dialogs/certifycertificatedialog.cpp
index b83404ae7..a0c882935 100644
--- a/src/dialogs/certifycertificatedialog.cpp
+++ b/src/dialogs/certifycertificatedialog.cpp
@@ -1,150 +1,161 @@
 /* -*- mode: c++; c-basic-offset:4 -*-
     dialogs/signcertificatedialog.cpp
 
     This file is part of Kleopatra, the KDE keymanager
     SPDX-FileCopyrightText: 2008 Klarälvdalens Datakonsult AB
     SPDX-FileCopyrightText: 2019 g10code GmbH
 
     SPDX-License-Identifier: GPL-2.0-or-later
 */
 
 #include <config-kleopatra.h>
 
 #include "kleopatra_debug.h"
 
 #include "certifycertificatedialog.h"
 
 #include "certifywidget.h"
 
 #include <utils/keys.h>
 
 #include <Libkleo/Algorithm>
 #include <Libkleo/Formatting>
 #include <Libkleo/Stl_Util>
 
 #include <KConfigGroup>
 #include <KLocalizedString>
 #include <KMessageBox>
 #include <KSharedConfig>
 #include <KStandardGuiItem>
 
 #include <QDialogButtonBox>
 #include <QKeyEvent>
 #include <QPushButton>
 #include <QVBoxLayout>
 
 #include <gpg-error.h>
 
 using namespace GpgME;
 using namespace Kleo;
 
 CertifyCertificateDialog::CertifyCertificateDialog(QWidget *p, Qt::WindowFlags f)
     : QDialog(p, f)
 {
+    setWindowTitle(i18nc("@title:window", "Certify Certificates"));
     setWindowFlags(windowFlags() & (~Qt::WindowContextHelpButtonHint));
 
     // Setup GUI
     auto mainLay = new QVBoxLayout(this);
     mCertWidget = new CertifyWidget(this);
     mainLay->addWidget(mCertWidget);
 
     auto buttonBox = new QDialogButtonBox{this};
     buttonBox->setStandardButtons(QDialogButtonBox::Cancel | QDialogButtonBox::Ok);
     const auto okButton = buttonBox->button(QDialogButtonBox::Ok);
     KGuiItem::assign(okButton, KStandardGuiItem::ok());
     okButton->setText(i18n("Certify"));
     KGuiItem::assign(buttonBox->button(QDialogButtonBox::Cancel), KStandardGuiItem::cancel());
     connect(buttonBox, &QDialogButtonBox::accepted, this, &CertifyCertificateDialog::accept);
     connect(buttonBox, &QDialogButtonBox::rejected, this, &QDialog::close);
 
     mainLay->addWidget(buttonBox);
 
     okButton->setEnabled(mCertWidget->isValid());
     connect(mCertWidget, &CertifyWidget::changed, this, [this, okButton]() {
         okButton->setEnabled(mCertWidget->isValid());
     });
 
     KConfigGroup cfgGroup(KSharedConfig::openStateConfig(), "CertifyDialog");
     const auto size = cfgGroup.readEntry("Size", QSize{640, 480});
     if (size.isValid()) {
         resize(size);
     }
 }
 
 CertifyCertificateDialog::~CertifyCertificateDialog()
 {
     KConfigGroup cfgGroup(KSharedConfig::openStateConfig(), "CertifyDialog");
     cfgGroup.writeEntry("Size", size());
     cfgGroup.sync();
 }
 
 void CertifyCertificateDialog::setCertificateToCertify(const Key &key, const std::vector<GpgME::UserID> &uids)
 {
     Q_ASSERT(Kleo::all_of(uids, [key](const auto &uid) {
         return Kleo::userIDBelongsToKey(uid, key);
     }));
     setWindowTitle(i18nc("@title:window arg is name, email of certificate holder", "Certify Certificate: %1", Formatting::prettyName(key)));
     mCertWidget->setCertificate(key, uids);
 }
 
+void CertifyCertificateDialog::setCertificatesToCertify(const std::vector<GpgME::Key> &keys)
+{
+    mCertWidget->setCertificates(keys);
+}
+
+void CertifyCertificateDialog::setGroupName(const QString &name)
+{
+    setWindowTitle(i18nc("@title:window Certify Certificate Group <group name>", "Certify Certificate Group %1", name));
+}
+
 bool CertifyCertificateDialog::exportableCertificationSelected() const
 {
     return mCertWidget->exportableSelected();
 }
 
 bool CertifyCertificateDialog::trustSignatureSelected() const
 {
     return mCertWidget->trustSignatureSelected();
 }
 
 QString CertifyCertificateDialog::trustSignatureDomain() const
 {
     return mCertWidget->trustSignatureDomain();
 }
 
 Key CertifyCertificateDialog::selectedSecretKey() const
 {
     return mCertWidget->secKey();
 }
 
 bool CertifyCertificateDialog::sendToServer() const
 {
     return mCertWidget->publishSelected();
 }
 
 void CertifyCertificateDialog::setSelectedUserIDs(const std::vector<UserID> &uids)
 {
     mCertWidget->selectUserIDs(uids);
 }
 
 std::vector<GpgME::UserID> CertifyCertificateDialog::selectedUserIDs() const
 {
     return mCertWidget->selectedUserIDs();
 }
 
 QString CertifyCertificateDialog::tags() const
 {
     return mCertWidget->tags();
 }
 
 QDate CertifyCertificateDialog::expirationDate() const
 {
     return mCertWidget->expirationDate();
 }
 
 void CertifyCertificateDialog::accept()
 {
     if (!mCertWidget->isValid()) {
         return;
     }
 
     KConfigGroup conf(KSharedConfig::openConfig(), "CertifySettings");
     const auto lastKey = mCertWidget->secKey();
     if (!lastKey.isNull()) {
         conf.writeEntry("LastKey", lastKey.primaryFingerprint());
     }
     conf.writeEntry("ExportCheckState", mCertWidget->exportableSelected());
     conf.writeEntry("PublishCheckState", mCertWidget->publishSelected());
 
     QDialog::accept();
 }
diff --git a/src/dialogs/certifycertificatedialog.h b/src/dialogs/certifycertificatedialog.h
index 76023cf30..d26099bc2 100644
--- a/src/dialogs/certifycertificatedialog.h
+++ b/src/dialogs/certifycertificatedialog.h
@@ -1,57 +1,64 @@
 /* -*- mode: c++; c-basic-offset:4 -*-
     dialogs/signcertificatedialog.h
 
     This file is part of Kleopatra, the KDE keymanager
     SPDX-FileCopyrightText: 2008 Klarälvdalens Datakonsult AB
 
     SPDX-License-Identifier: GPL-2.0-or-later
 */
 
 #pragma once
 
 #include <QWizard>
 
 #include <QGpgME/SignKeyJob>
 
 #include <gpgme++/key.h>
 
 #include <utils/pimpl_ptr.h>
 
 namespace Kleo
 {
 
 class CertifyWidget;
 
 class CertifyCertificateDialog : public QDialog
 {
     Q_OBJECT
 public:
     explicit CertifyCertificateDialog(QWidget *parent = nullptr, Qt::WindowFlags f = {});
     ~CertifyCertificateDialog() override;
 
+    /** Sets the certificate to certify for certifying user IDs of a single certificate. */
     void setCertificateToCertify(const GpgME::Key &key, const std::vector<GpgME::UserID> &uids = {});
 
+    /** Sets the certificates to certify for bulk certification. */
+    void setCertificatesToCertify(const std::vector<GpgME::Key> &keys);
+
+    /** Set the optional group name when certifying the certificates of a certificate group. */
+    void setGroupName(const QString &name);
+
     bool exportableCertificationSelected() const;
 
     bool trustSignatureSelected() const;
     QString trustSignatureDomain() const;
 
     void setSelectedUserIDs(const std::vector<GpgME::UserID> &uids);
     std::vector<GpgME::UserID> selectedUserIDs() const;
 
     GpgME::Key selectedSecretKey() const;
 
     bool sendToServer() const;
 
     QString tags() const;
 
     QDate expirationDate() const;
 
 public Q_SLOTS:
     void accept() override;
 
 private:
-    CertifyWidget *mCertWidget;
+    CertifyWidget *mCertWidget = nullptr;
 };
 
 }