diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 1a0f7a782..f92e8e160 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -1,623 +1,621 @@
 # SPDX-FileCopyrightText: none
 # SPDX-License-Identifier: BSD-3-Clause
 add_subdirectory(icons)
 add_subdirectory(mimetypes)
 
 include_directories(${CMAKE_CURRENT_BINARY_DIR})
 include_directories(${CMAKE_CURRENT_SOURCE_DIR})
 
 if (NOT DISABLE_KWATCHGNUPG)
     add_subdirectory(kwatchgnupg)
 endif()
 add_subdirectory(libkleopatraclient)
 add_subdirectory(conf)
 add_subdirectory(kconf_update)
 
 if(WIN32)
   set(_kleopatra_extra_uiserver_SRCS uiserver/uiserver_win.cpp)
   set(_kleopatra_extra_SRCS
       selftest/registrycheck.cpp
       utils/gnupg-registry.c
       utils/userinfo_win.cpp
       utils/windowsprocessdevice.cpp
   )
 else()
   set(_kleopatra_extra_uiserver_SRCS uiserver/uiserver_unix.cpp)
   set(_kleopatra_extra_SRCS)
 endif()
 
 set(_kleopatra_uiserver_SRCS
     ${_kleopatra_extra_uiserver_SRCS}
 
     selftest/uiservercheck.cpp
     uiserver/assuanserverconnection.cpp
     uiserver/createchecksumscommand.cpp
     uiserver/decryptverifycommandemailbase.cpp
     uiserver/decryptverifycommandfilesbase.cpp
     uiserver/echocommand.cpp
     uiserver/encryptcommand.cpp
     uiserver/importfilescommand.cpp
     uiserver/prepencryptcommand.cpp
     uiserver/prepsigncommand.cpp
     uiserver/selectcertificatecommand.cpp
     uiserver/sessiondata.cpp
     uiserver/signcommand.cpp
     uiserver/signencryptfilescommand.cpp
     uiserver/uiserver.cpp
     uiserver/verifychecksumscommand.cpp
   )
 
 if(ASSUAN2_FOUND)
   include_directories(${ASSUAN2_INCLUDES})
   set(_kleopatra_uiserver_extra_libs ${ASSUAN2_LIBRARIES})
 else()
   include_directories(${ASSUAN_INCLUDES})
   if(WIN32)
     set(_kleopatra_uiserver_extra_libs ${ASSUAN_VANILLA_LIBRARIES})
   else()
     set(_kleopatra_uiserver_extra_libs ${ASSUAN_PTHREAD_LIBRARIES})
   endif()
 endif()
 
 if(HAVE_GPG_ERR_SOURCE_KLEO)
   add_definitions(-DGPG_ERR_SOURCE_DEFAULT=GPG_ERR_SOURCE_KLEO)
   add_definitions(-DGPGMEPP_ERR_SOURCE_DEFAULT=GPG_ERR_SOURCE_KLEO)
 else()
   add_definitions(-DGPG_ERR_SOURCE_DEFAULT=GPG_ERR_SOURCE_USER_1)
   add_definitions(-DGPGMEPP_ERR_SOURCE_DEFAULT=GPG_ERR_SOURCE_USER_1)
 endif()
 
 if(KF5IdentityManagement_FOUND AND KF5MailTransport_FOUND AND KF5MailTransportAkonadi_FOUND)
   set(_kleopatra_mail_libs
       KF5::IdentityManagement # Export OpenPGP keys using WKS
       KF5::MailTransport
       KF5::MailTransportAkonadi
   )
   add_definitions(-DMAILAKONADI_ENABLED)
 endif()
 
 ki18n_wrap_ui(_kleopatra_uiserver_SRCS crypto/gui/signingcertificateselectionwidget.ui)
 
 set(_kleopatra_SRCS
   ${_kleopatra_extra_SRCS}
 
   accessibility/accessiblelink.cpp
   accessibility/accessiblelink_p.h
   accessibility/accessiblerichtextlabel.cpp
   accessibility/accessiblerichtextlabel_p.h
   accessibility/accessiblewidgetfactory.cpp
   accessibility/accessiblewidgetfactory.h
   commands/adduseridcommand.cpp
   commands/adduseridcommand.h
   commands/authenticatepivcardapplicationcommand.cpp
   commands/authenticatepivcardapplicationcommand.h
   commands/cardcommand.cpp
   commands/cardcommand.h
   commands/certificatetopivcardcommand.cpp
   commands/certificatetopivcardcommand.h
   commands/certifycertificatecommand.cpp
   commands/certifycertificatecommand.h
   commands/changeexpirycommand.cpp
   commands/changeexpirycommand.h
   commands/changeownertrustcommand.cpp
   commands/changeownertrustcommand.h
   commands/changepassphrasecommand.cpp
   commands/changepassphrasecommand.h
   commands/changepincommand.cpp
   commands/changepincommand.h
   commands/changeroottrustcommand.cpp
   commands/changeroottrustcommand.h
   commands/checksumcreatefilescommand.cpp
   commands/checksumcreatefilescommand.h
   commands/checksumverifyfilescommand.cpp
   commands/checksumverifyfilescommand.h
   commands/clearcrlcachecommand.cpp
   commands/clearcrlcachecommand.h
   commands/command.cpp
   commands/command.h
   commands/createcsrforcardkeycommand.cpp
   commands/createcsrforcardkeycommand.h
   commands/createopenpgpkeyfromcardkeyscommand.cpp
   commands/createopenpgpkeyfromcardkeyscommand.h
   commands/decryptverifyclipboardcommand.cpp
   commands/decryptverifyclipboardcommand.h
   commands/decryptverifyfilescommand.cpp
   commands/decryptverifyfilescommand.h
   commands/deletecertificatescommand.cpp
   commands/deletecertificatescommand.h
   commands/detailscommand.cpp
   commands/detailscommand.h
   commands/dumpcertificatecommand.cpp
   commands/dumpcertificatecommand.h
   commands/dumpcrlcachecommand.cpp
   commands/dumpcrlcachecommand.h
   commands/encryptclipboardcommand.cpp
   commands/encryptclipboardcommand.h
   commands/exportcertificatecommand.cpp
   commands/exportcertificatecommand.h
   commands/exportgroupscommand.cpp
   commands/exportgroupscommand.h
   commands/exportopenpgpcertstoservercommand.cpp
   commands/exportopenpgpcertstoservercommand.h
   commands/exportopenpgpcerttoprovidercommand.cpp
   commands/exportopenpgpcerttoprovidercommand.h
   commands/exportpaperkeycommand.cpp
   commands/exportpaperkeycommand.h
   commands/exportsecretkeycommand.cpp
   commands/exportsecretkeycommand.h
   commands/exportsecretkeycommand_old.cpp
   commands/exportsecretkeycommand_old.h
   commands/exportsecretsubkeycommand.cpp
   commands/exportsecretsubkeycommand.h
   commands/genrevokecommand.cpp
   commands/genrevokecommand.h
   commands/gnupgprocesscommand.cpp
   commands/gnupgprocesscommand.h
   commands/importcertificatefromclipboardcommand.cpp
   commands/importcertificatefromclipboardcommand.h
   commands/importcertificatefromdatacommand.cpp
   commands/importcertificatefromdatacommand.h
   commands/importcertificatefromfilecommand.cpp
   commands/importcertificatefromfilecommand.h
   commands/importcertificatefromkeyservercommand.cpp
   commands/importcertificatefromkeyservercommand.h
   commands/importcertificatefrompivcardcommand.cpp
   commands/importcertificatefrompivcardcommand.h
   commands/importcertificatescommand.cpp
   commands/importcertificatescommand.h
   commands/importcrlcommand.cpp
   commands/importcrlcommand.h
   commands/importpaperkeycommand.cpp
   commands/importpaperkeycommand.h
   commands/keytocardcommand.cpp
   commands/keytocardcommand.h
   commands/learncardkeyscommand.cpp
   commands/learncardkeyscommand.h
   commands/lookupcertificatescommand.cpp
   commands/lookupcertificatescommand.h
   commands/newcertificatecommand.cpp
   commands/newcertificatecommand.h
   commands/newopenpgpcertificatecommand.cpp
   commands/newopenpgpcertificatecommand.h
   commands/pivgeneratecardkeycommand.cpp
   commands/pivgeneratecardkeycommand.h
   commands/refreshcertificatecommand.cpp
   commands/refreshcertificatecommand.h
   commands/refreshopenpgpcertscommand.cpp
   commands/refreshopenpgpcertscommand.h
   commands/refreshx509certscommand.cpp
   commands/refreshx509certscommand.h
   commands/reloadkeyscommand.cpp
   commands/reloadkeyscommand.h
   commands/revokecertificationcommand.cpp
   commands/revokecertificationcommand.h
   commands/revokekeycommand.cpp
   commands/revokekeycommand.h
   commands/revokeuseridcommand.cpp
   commands/revokeuseridcommand.h
   commands/selftestcommand.cpp
   commands/selftestcommand.h
   commands/setinitialpincommand.cpp
   commands/setinitialpincommand.h
   commands/setpivcardapplicationadministrationkeycommand.cpp
   commands/setpivcardapplicationadministrationkeycommand.h
   commands/signclipboardcommand.cpp
   commands/signclipboardcommand.h
   commands/signencryptfilescommand.cpp
   commands/signencryptfilescommand.h
   commands/signencryptfoldercommand.cpp
   commands/signencryptfoldercommand.h
   conf/configuredialog.cpp
   conf/configuredialog.h
   conf/groupsconfigdialog.cpp
   conf/groupsconfigdialog.h
   conf/groupsconfigpage.cpp
   conf/groupsconfigpage.h
   conf/groupsconfigwidget.cpp
   conf/groupsconfigwidget.h
   crypto/autodecryptverifyfilescontroller.cpp
   crypto/autodecryptverifyfilescontroller.h
   crypto/certificateresolver.cpp
   crypto/certificateresolver.h
   crypto/checksumsutils_p.cpp
   crypto/checksumsutils_p.h
   crypto/controller.cpp
   crypto/controller.h
   crypto/createchecksumscontroller.cpp
   crypto/createchecksumscontroller.h
   crypto/decryptverifyemailcontroller.cpp
   crypto/decryptverifyemailcontroller.h
   crypto/decryptverifyfilescontroller.cpp
   crypto/decryptverifyfilescontroller.h
   crypto/decryptverifytask.cpp
   crypto/decryptverifytask.h
   crypto/encryptemailcontroller.cpp
   crypto/encryptemailcontroller.h
   crypto/encryptemailtask.cpp
   crypto/encryptemailtask.h
   crypto/gui/certificatelineedit.cpp
   crypto/gui/certificatelineedit.h
   crypto/gui/certificateselectionline.cpp
   crypto/gui/certificateselectionline.h
   crypto/gui/decryptverifyfilesdialog.cpp
   crypto/gui/decryptverifyfilesdialog.h
   crypto/gui/decryptverifyfileswizard.cpp
   crypto/gui/decryptverifyfileswizard.h
   crypto/gui/decryptverifyoperationwidget.cpp
   crypto/gui/decryptverifyoperationwidget.h
   crypto/gui/encryptemailwizard.cpp
   crypto/gui/encryptemailwizard.h
   crypto/gui/newresultpage.cpp
   crypto/gui/newresultpage.h
   crypto/gui/objectspage.cpp
   crypto/gui/objectspage.h
   crypto/gui/resolverecipientspage.cpp
   crypto/gui/resolverecipientspage.h
   crypto/gui/resultitemwidget.cpp
   crypto/gui/resultitemwidget.h
   crypto/gui/resultlistwidget.cpp
   crypto/gui/resultlistwidget.h
   crypto/gui/resultpage.cpp
   crypto/gui/resultpage.h
   crypto/gui/signemailwizard.cpp
   crypto/gui/signemailwizard.h
   crypto/gui/signencryptemailconflictdialog.cpp
   crypto/gui/signencryptemailconflictdialog.h
   crypto/gui/signencryptfileswizard.cpp
   crypto/gui/signencryptfileswizard.h
   crypto/gui/signencryptwidget.cpp
   crypto/gui/signencryptwidget.h
   crypto/gui/signencryptwizard.cpp
   crypto/gui/signencryptwizard.h
   crypto/gui/signerresolvepage.cpp
   crypto/gui/signerresolvepage.h
   crypto/gui/signingcertificateselectiondialog.cpp
   crypto/gui/signingcertificateselectiondialog.h
   crypto/gui/signingcertificateselectionwidget.cpp
   crypto/gui/signingcertificateselectionwidget.h
   crypto/gui/unknownrecipientwidget.cpp
   crypto/gui/unknownrecipientwidget.h
   crypto/gui/verifychecksumsdialog.cpp
   crypto/gui/verifychecksumsdialog.h
   crypto/gui/wizard.cpp
   crypto/gui/wizard.h
   crypto/gui/wizardpage.cpp
   crypto/gui/wizardpage.h
   crypto/newsignencryptemailcontroller.cpp
   crypto/newsignencryptemailcontroller.h
   crypto/recipient.cpp
   crypto/recipient.h
   crypto/sender.cpp
   crypto/sender.h
   crypto/signemailcontroller.cpp
   crypto/signemailcontroller.h
   crypto/signemailtask.cpp
   crypto/signemailtask.h
   crypto/signencryptfilescontroller.cpp
   crypto/signencryptfilescontroller.h
   crypto/signencrypttask.cpp
   crypto/signencrypttask.h
   crypto/task.cpp
   crypto/task.h
   crypto/taskcollection.cpp
   crypto/taskcollection.h
   crypto/verifychecksumscontroller.cpp
   crypto/verifychecksumscontroller.h
   dialogs/adduseriddialog.cpp
   dialogs/adduseriddialog.h
   dialogs/certificatedetailsdialog.cpp
   dialogs/certificatedetailsdialog.h
   dialogs/certificatedetailsinputwidget.cpp
   dialogs/certificatedetailsinputwidget.h
   dialogs/certificatedetailswidget.cpp
   dialogs/certificatedetailswidget.h
   dialogs/certificateselectiondialog.cpp
   dialogs/certificateselectiondialog.h
   dialogs/certifycertificatedialog.cpp
   dialogs/certifycertificatedialog.h
   dialogs/certifywidget.cpp
   dialogs/certifywidget.h
-  dialogs/choosecertificateprotocoldialog.cpp
-  dialogs/choosecertificateprotocoldialog.h
   dialogs/createcsrforcardkeydialog.cpp
   dialogs/createcsrforcardkeydialog.h
   dialogs/deletecertificatesdialog.cpp
   dialogs/deletecertificatesdialog.h
   dialogs/editgroupdialog.cpp
   dialogs/editgroupdialog.h
   dialogs/expirydialog.cpp
   dialogs/expirydialog.h
   dialogs/exportdialog.cpp
   dialogs/exportdialog.h
   dialogs/gencardkeydialog.cpp
   dialogs/gencardkeydialog.h
   dialogs/groupdetailsdialog.cpp
   dialogs/groupdetailsdialog.h
   dialogs/lookupcertificatesdialog.cpp
   dialogs/lookupcertificatesdialog.h
   dialogs/nameandemailwidget.cpp
   dialogs/nameandemailwidget.h
   dialogs/newopenpgpcertificatedetailsdialog.cpp
   dialogs/newopenpgpcertificatedetailsdialog.h
   dialogs/newopenpgpcertificateresultdialog.cpp
   dialogs/newopenpgpcertificateresultdialog.h
   dialogs/ownertrustdialog.cpp
   dialogs/ownertrustdialog.h
   dialogs/pivcardapplicationadministrationkeyinputdialog.cpp
   dialogs/pivcardapplicationadministrationkeyinputdialog.h
   dialogs/revokecertificationdialog.cpp
   dialogs/revokecertificationdialog.h
   dialogs/revokecertificationwidget.cpp
   dialogs/revokecertificationwidget.h
   dialogs/revokekeydialog.cpp
   dialogs/revokekeydialog.h
   dialogs/selftestdialog.cpp
   dialogs/selftestdialog.h
   dialogs/setinitialpindialog.cpp
   dialogs/setinitialpindialog.h
   dialogs/subkeyswidget.cpp
   dialogs/subkeyswidget.h
   dialogs/trustchainwidget.cpp
   dialogs/trustchainwidget.h
   dialogs/updatenotification.cpp
   dialogs/updatenotification.h
   dialogs/weboftrustdialog.cpp
   dialogs/weboftrustdialog.h
   dialogs/weboftrustwidget.cpp
   dialogs/weboftrustwidget.h
   interfaces/anchorprovider.h
   interfaces/focusfirstchild.h
   newcertificatewizard/advancedsettingsdialog.cpp
   newcertificatewizard/advancedsettingsdialog_p.h
   newcertificatewizard/enterdetailspage.cpp
   newcertificatewizard/enterdetailspage_p.h
   newcertificatewizard/keyalgo.cpp
   newcertificatewizard/keyalgo_p.h
   newcertificatewizard/keycreationpage.cpp
   newcertificatewizard/keycreationpage_p.h
   newcertificatewizard/listwidget.cpp
   newcertificatewizard/listwidget.h
   newcertificatewizard/newcertificatewizard.cpp
   newcertificatewizard/newcertificatewizard.h
   newcertificatewizard/resultpage.cpp
   newcertificatewizard/resultpage_p.h
   newcertificatewizard/wizardpage.cpp
   newcertificatewizard/wizardpage_p.h
   selftest/compliancecheck.cpp
   selftest/compliancecheck.h
   selftest/enginecheck.cpp
   selftest/enginecheck.h
   selftest/gpgagentcheck.cpp
   selftest/gpgagentcheck.h
   selftest/gpgconfcheck.cpp
   selftest/gpgconfcheck.h
   selftest/libkleopatrarccheck.cpp
   selftest/libkleopatrarccheck.h
   selftest/selftest.cpp
   selftest/selftest.h
   smartcard/card.cpp
   smartcard/card.h
   smartcard/deviceinfowatcher.cpp
   smartcard/deviceinfowatcher.h
   smartcard/keypairinfo.cpp
   smartcard/keypairinfo.h
   smartcard/netkeycard.cpp
   smartcard/netkeycard.h
   smartcard/openpgpcard.cpp
   smartcard/openpgpcard.h
   smartcard/p15card.cpp
   smartcard/p15card.h
   smartcard/pivcard.cpp
   smartcard/pivcard.h
   smartcard/readerstatus.cpp
   smartcard/readerstatus.h
   smartcard/utils.cpp
   smartcard/utils.h
   utils/accessibility.cpp
   utils/accessibility.h
   utils/action_data.cpp
   utils/action_data.h
   utils/archivedefinition.cpp
   utils/archivedefinition.h
   utils/auditlog.cpp
   utils/auditlog.h
   utils/clipboardmenu.cpp
   utils/clipboardmenu.h
   utils/debug-helpers.cpp
   utils/debug-helpers.h
   utils/dragqueen.cpp
   utils/dragqueen.h
   utils/email.cpp
   utils/email.h
   utils/emptypassphraseprovider.cpp
   utils/emptypassphraseprovider.h
   utils/filedialog.cpp
   utils/filedialog.h
   utils/gui-helper.cpp
   utils/gui-helper.h
   utils/headerview.cpp
   utils/headerview.h
   utils/input.cpp
   utils/input.h
   utils/iodevicelogger.cpp
   utils/iodevicelogger.h
   utils/kdpipeiodevice.cpp
   utils/kdpipeiodevice.h
   utils/keyparameters.cpp
   utils/keyparameters.h
   utils/keys.cpp
   utils/keys.h
   utils/kuniqueservice.cpp
   utils/kuniqueservice.h
   utils/log.cpp
   utils/log.h
   utils/multivalidator.cpp
   utils/multivalidator.h
   utils/output.cpp
   utils/output.h
   utils/path-helper.cpp
   utils/path-helper.h
   utils/scrollarea.cpp
   utils/scrollarea.h
   utils/systemtrayicon.cpp
   utils/systemtrayicon.h
   utils/tags.cpp
   utils/tags.h
   utils/types.cpp
   utils/types.h
   utils/userinfo.cpp
   utils/userinfo.h
   utils/validation.cpp
   utils/validation.h
   utils/writecertassuantransaction.cpp
   utils/writecertassuantransaction.h
   utils/wsastarter.cpp
   utils/wsastarter.h
   view/anchorcache.cpp
   view/anchorcache_p.h
   view/errorlabel.cpp
   view/errorlabel.h
   view/formtextinput.cpp
   view/formtextinput.h
   view/htmllabel.cpp
   view/htmllabel.h
   view/keycacheoverlay.cpp
   view/keycacheoverlay.h
   view/keylistcontroller.cpp
   view/keylistcontroller.h
   view/keytreeview.cpp
   view/keytreeview.h
   view/netkeywidget.cpp
   view/netkeywidget.h
   view/nullpinwidget.cpp
   view/nullpinwidget.h
   view/openpgpkeycardwidget.cpp
   view/openpgpkeycardwidget.h
   view/p15cardwidget.cpp
   view/p15cardwidget.h
   view/padwidget.cpp
   view/padwidget.h
   view/pgpcardwidget.cpp
   view/pgpcardwidget.h
   view/pivcardwidget.cpp
   view/pivcardwidget.h
   view/searchbar.cpp
   view/searchbar.h
   view/smartcardwidget.cpp
   view/smartcardwidget.h
   view/tabwidget.cpp
   view/tabwidget.h
   view/urllabel.cpp
   view/urllabel.h
   view/waitwidget.cpp
   view/waitwidget.h
   view/welcomewidget.cpp
   view/welcomewidget.h
 
   aboutdata.cpp
   aboutdata.h
   kleopatra.qrc
   kleopatraapplication.cpp
   kleopatraapplication.h
   main.cpp
   mainwindow.cpp
   mainwindow.h
   systrayicon.cpp
   systrayicon.h
 )
 
 if(WIN32)
   configure_file (versioninfo.rc.in versioninfo.rc)
   set(_kleopatra_SRCS ${CMAKE_CURRENT_BINARY_DIR}/versioninfo.rc ${_kleopatra_SRCS})
 endif()
 
 set (_kleopatra_SRCS conf/kleopageconfigdialog.cpp ${_kleopatra_SRCS})
 
 ecm_qt_declare_logging_category(_kleopatra_SRCS HEADER kleopatra_debug.h IDENTIFIER KLEOPATRA_LOG CATEGORY_NAME org.kde.pim.kleopatra
         DESCRIPTION "kleopatra (kleopatra)"
         OLD_CATEGORY_NAMES log_kleopatra
         EXPORT KLEOPATRA
     )
 
 
 if(KLEO_MODEL_TEST)
   add_definitions(-DKLEO_MODEL_TEST)
   set(_kleopatra_SRCS ${_kleopatra_SRCS} models/modeltest.cpp)
 endif()
 
 ki18n_wrap_ui(_kleopatra_SRCS
   dialogs/ownertrustdialog.ui
   dialogs/selectchecklevelwidget.ui
   dialogs/selftestdialog.ui
   dialogs/setinitialpindialog.ui
   dialogs/trustchainwidget.ui
   newcertificatewizard/listwidget.ui
 )
 
 kconfig_add_kcfg_files(_kleopatra_SRCS
   kcfg/emailoperationspreferences.kcfgc
   kcfg/fileoperationspreferences.kcfgc
   kcfg/settings.kcfgc
   kcfg/smimevalidationpreferences.kcfgc
   kcfg/tagspreferences.kcfgc
   kcfg/tooltippreferences.kcfgc
 )
 
 file(GLOB ICONS_SRCS "${CMAKE_CURRENT_SOURCE_DIR}/icons/*-apps-kleopatra.png")
 ecm_add_app_icon(_kleopatra_SRCS ICONS ${ICONS_SRCS})
 
 add_executable(kleopatra_bin ${_kleopatra_SRCS} ${_kleopatra_uiserver_SRCS})
 
 # For the ConfigureDialog & KCMs
 target_link_libraries(kleopatra_bin kcm_kleopatra_static)
 
 #if (COMPILE_WITH_UNITY_CMAKE_SUPPORT)
 #    set_target_properties(kleopatra_bin PROPERTIES UNITY_BUILD ON)
 #endif()
 set_target_properties(kleopatra_bin PROPERTIES OUTPUT_NAME kleopatra)
 
 if (WIN32)
   set(_kleopatra_platform_libs "secur32")
 endif ()
 
 target_link_libraries(kleopatra_bin
   Gpgmepp
   ${_kleopatra_extra_libs}
   KF5::Libkleo
   KF5::Mime
   KF5::I18n
   KF5::XmlGui
   KF5::IconThemes
   KF5::WindowSystem
   KF5::CoreAddons
   KF5::ItemModels
   KF5::Crash
   ${_kleopatra_mail_libs}
   Qt${QT_MAJOR_VERSION}::Network
   Qt${QT_MAJOR_VERSION}::PrintSupport # Printing secret keys
   ${_kleopatra_uiserver_extra_libs}
   ${_kleopatra_dbusaddons_libs}
   kleopatraclientcore
   ${_kleopatra_platform_libs}
 )
 
 if (QT_MAJOR_VERSION STREQUAL "6")
     target_link_libraries(kleopatra_bin QGpgmeQt6)
 else()
     target_link_libraries(kleopatra_bin QGpgme)
 endif()
 
 install(TARGETS kleopatra_bin ${KDE_INSTALL_TARGETS_DEFAULT_ARGS})
 
 install(
   PROGRAMS data/org.kde.kleopatra.desktop data/kleopatra_import.desktop
   DESTINATION ${KDE_INSTALL_APPDIR}
 )
 install(FILES data/org.kde.kleopatra.appdata.xml DESTINATION ${KDE_INSTALL_METAINFODIR})
 install(
   PROGRAMS data/kleopatra_signencryptfiles.desktop
         data/kleopatra_signencryptfolders.desktop
         data/kleopatra_decryptverifyfiles.desktop
         data/kleopatra_decryptverifyfolders.desktop
   DESTINATION ${KDE_INSTALL_DATADIR}/kio/servicemenus
 )
diff --git a/src/commands/newcertificatecommand.cpp b/src/commands/newcertificatecommand.cpp
index 6c0328a75..d3f4a0e6c 100644
--- a/src/commands/newcertificatecommand.cpp
+++ b/src/commands/newcertificatecommand.cpp
@@ -1,190 +1,128 @@
 /* -*- mode: c++; c-basic-offset:4 -*-
     commands/newcertificatecommand.cpp
 
     This file is part of Kleopatra, the KDE keymanager
     SPDX-FileCopyrightText: 2008 Klarälvdalens Datakonsult AB
     SPDX-FileCopyrightText: 2022 g10 Code GmbH
     SPDX-FileContributor: Ingo Klöcker <dev@ingo-kloecker.de>
 
     SPDX-License-Identifier: GPL-2.0-or-later
 */
 
 #include <config-kleopatra.h>
 
 #include "newcertificatecommand.h"
 
 #include "command_p.h"
 #include "newopenpgpcertificatecommand.h"
 
-#include "dialogs/choosecertificateprotocoldialog.h"
 #include "newcertificatewizard/newcertificatewizard.h"
 
 #include <settings.h>
 
 #include <kleopatra_debug.h>
 
 using namespace Kleo;
 using namespace Kleo::Commands;
 using namespace GpgME;
 
 class NewCertificateCommand::Private : public Command::Private
 {
     friend class ::Kleo::Commands::NewCertificateCommand;
     NewCertificateCommand *q_func() const
     {
         return static_cast<NewCertificateCommand *>(q);
     }
 public:
     explicit Private(NewCertificateCommand *qq, KeyListController *c)
         : Command::Private{qq, c}
     {
     }
 
-    void chooseProtocol();
     void createCertificate();
 
 private:
-    void onProtocolChosen();
-
     void slotDialogAccepted();
 
 private:
     void ensureDialogCreated();
 
 private:
-    Protocol protocol = GpgME::UnknownProtocol;
-    QPointer<ChooseCertificateProtocolDialog> protocolDialog;
     QPointer<NewCertificateWizard> dialog;
 };
 
 NewCertificateCommand::Private *NewCertificateCommand::d_func()
 {
     return static_cast<Private *>(d.get());
 }
 const NewCertificateCommand::Private *NewCertificateCommand::d_func() const
 {
     return static_cast<const Private *>(d.get());
 }
 
 #define d d_func()
 #define q q_func()
 
-void NewCertificateCommand::Private::chooseProtocol()
+void NewCertificateCommand::Private::createCertificate()
 {
-    Q_ASSERT(protocol == GpgME::UnknownProtocol);
-    Q_ASSERT(!protocolDialog);
+    Q_ASSERT(!dialog);
 
-    protocolDialog = new ChooseCertificateProtocolDialog;
-    applyWindowID(protocolDialog);
+    dialog = new NewCertificateWizard;
+    applyWindowID(dialog);
+    dialog->setAttribute(Qt::WA_DeleteOnClose);
 
-    connect(protocolDialog, &QDialog::accepted, q, [this]() {
-        onProtocolChosen();
+    connect(dialog, &QDialog::accepted, q, [this]() {
+        slotDialogAccepted();
     });
-    connect(protocolDialog, &QDialog::rejected, q, [this]() {
+    connect(dialog, &QDialog::rejected, q, [this]() {
         canceled();
-        protocolDialog->deleteLater();
     });
 
-    protocolDialog->show();
-}
-
-void NewCertificateCommand::Private::onProtocolChosen()
-{
-    protocol = protocolDialog->protocol();
-    protocolDialog->deleteLater();
-
-    createCertificate();
-}
-
-void Kleo::Commands::NewCertificateCommand::Private::createCertificate()
-{
-    Q_ASSERT(protocol != GpgME::UnknownProtocol);
-
-    if (protocol == GpgME::OpenPGP) {
-        auto cmd = new NewOpenPGPCertificateCommand{view(), controller()};
-        if (parentWidgetOrView() != view()) {
-            cmd->setParentWidget(parentWidgetOrView());
-        }
-        cmd->setParentWId(parentWId());
-        connect(cmd, &NewOpenPGPCertificateCommand::finished,
-                q, [this]() { finished(); });
-        connect(cmd, &NewOpenPGPCertificateCommand::canceled,
-                q, [this]() { canceled(); });
-        cmd->start();
-    } else {
-        Q_ASSERT(!dialog);
-
-        dialog = new NewCertificateWizard;
-        applyWindowID(dialog);
-        dialog->setAttribute(Qt::WA_DeleteOnClose);
-
-        connect(dialog, &QDialog::accepted, q, [this]() {
-            slotDialogAccepted();
-        });
-        connect(dialog, &QDialog::rejected, q, [this]() {
-            canceled();
-        });
-
-        dialog->setProtocol(protocol);
-        dialog->show();
-    }
+    dialog->setProtocol(GpgME::CMS);
+    dialog->show();
 }
 
 void NewCertificateCommand::Private::slotDialogAccepted()
 {
     finished();
 }
 
 NewCertificateCommand::NewCertificateCommand()
     : Command(new Private(this, nullptr))
 {
 }
 
 NewCertificateCommand::NewCertificateCommand(KeyListController *c)
     : Command(new Private(this, c))
 {
 }
 
 NewCertificateCommand::NewCertificateCommand(QAbstractItemView *v, KeyListController *c)
     : Command(v, new Private(this, c))
 {
 }
 
 NewCertificateCommand::~NewCertificateCommand() = default;
 
-void NewCertificateCommand::setProtocol(Protocol proto)
-{
-    d->protocol = proto;
-}
-
-Protocol NewCertificateCommand::protocol() const
-{
-    return d->protocol;
-}
-
 void NewCertificateCommand::doStart()
 {
     const Kleo::Settings settings{};
-    const auto cmsAllowed = settings.cmsEnabled() && settings.cmsCertificateCreationAllowed();
-    if (d->protocol == UnknownProtocol && !cmsAllowed) {
-        d->protocol = GpgME::OpenPGP;
-    }
-
-    if (d->protocol == UnknownProtocol) {
-        d->chooseProtocol();
-    } else {
+    if (settings.cmsEnabled() && settings.cmsCertificateCreationAllowed()) {
         d->createCertificate();
+    } else {
+        d->error(i18n("You are not allowed to create S/MIME certificate signing requests."));
+        d->finished();
     }
 }
 
 void NewCertificateCommand::doCancel()
 {
     if (d->dialog) {
         d->dialog->close();
     }
 }
 
 #undef d
 #undef q
 
 #include "moc_newcertificatecommand.cpp"
diff --git a/src/commands/newcertificatecommand.h b/src/commands/newcertificatecommand.h
index 97f6e6089..5f9a35d4b 100644
--- a/src/commands/newcertificatecommand.h
+++ b/src/commands/newcertificatecommand.h
@@ -1,45 +1,42 @@
 /* -*- mode: c++; c-basic-offset:4 -*-
     commands/newcertificatecommand.h
 
     This file is part of Kleopatra, the KDE keymanager
     SPDX-FileCopyrightText: 2008 Klarälvdalens Datakonsult AB
 
     SPDX-License-Identifier: GPL-2.0-or-later
 */
 
 #pragma once
 
 #include <commands/command.h>
 
 #include <gpgme++/global.h>
 
 namespace Kleo
 {
 namespace Commands
 {
 
 class NewCertificateCommand : public Command
 {
     Q_OBJECT
 public:
     explicit NewCertificateCommand(QAbstractItemView *view, KeyListController *parent);
     explicit NewCertificateCommand(KeyListController *parent);
     explicit NewCertificateCommand();
     ~NewCertificateCommand() override;
 
-    void setProtocol(GpgME::Protocol proto);
-    GpgME::Protocol protocol() const;
-
 private:
     void doStart() override;
     void doCancel() override;
 
 private:
     class Private;
     inline Private *d_func();
     inline const Private *d_func() const;
 };
 
 }
 }
 
diff --git a/src/dialogs/choosecertificateprotocoldialog.cpp b/src/dialogs/choosecertificateprotocoldialog.cpp
deleted file mode 100644
index ef0b8dbdc..000000000
--- a/src/dialogs/choosecertificateprotocoldialog.cpp
+++ /dev/null
@@ -1,150 +0,0 @@
-/* -*- mode: c++; c-basic-offset:4 -*-
-    dialogs/choosecertificateprotocoldialog.cpp
-
-    This file is part of Kleopatra, the KDE keymanager
-    SPDX-FileCopyrightText: 2008 Klarälvdalens Datakonsult AB
-    SPDX-FileCopyrightText: 2016, 2017 Bundesamt für Sicherheit in der Informationstechnik
-    SPDX-FileContributor: Intevation GmbH
-    SPDX-FileCopyrightText: 2022 g10 Code GmbH
-    SPDX-FileContributor: Ingo Klöcker <dev@ingo-kloecker.de>
-
-    SPDX-License-Identifier: GPL-2.0-or-later
-*/
-
-#include <config-kleopatra.h>
-
-#include "choosecertificateprotocoldialog.h"
-
-#include "utils/scrollarea.h"
-
-#include <KLocalizedString>
-#include <KSeparator>
-
-#include <QDialogButtonBox>
-#include <QGroupBox>
-#include <QLabel>
-#include <QPushButton>
-#include <QVBoxLayout>
-
-using namespace Kleo;
-
-class ChooseCertificateProtocolDialog::Private
-{
-    friend class ::Kleo::ChooseCertificateProtocolDialog;
-    ChooseCertificateProtocolDialog *const q;
-
-    struct UI {
-        QPushButton *openpgpButton = nullptr;
-        QPushButton *x509Button = nullptr;
-        QDialogButtonBox *buttonBox = nullptr;
-
-        UI(QDialog *parent)
-        {
-            auto mainLayout = new QVBoxLayout{parent};
-
-            {
-                auto label = new QLabel{i18n("Choose which type of key pair you want to create."), parent};
-                label->setWordWrap(true);
-                mainLayout->addWidget(label);
-            }
-
-            mainLayout->addWidget(new KSeparator{Qt::Horizontal, parent});
-
-            auto scrollArea = new ScrollArea{parent};
-            scrollArea->setFocusPolicy(Qt::NoFocus);
-            scrollArea->setFrameStyle(QFrame::NoFrame);
-            scrollArea->setBackgroundRole(parent->backgroundRole());
-            scrollArea->setHorizontalScrollBarPolicy(Qt::ScrollBarAlwaysOff);
-            auto scrollAreaLayout = qobject_cast<QBoxLayout *>(scrollArea->widget()->layout());
-            scrollAreaLayout->setContentsMargins(0, 0, 0, 0);
-
-            {
-                auto group = new QGroupBox{i18n("OpenPGP"), parent};
-                group->setFlat(true);
-                auto groupLayout = new QVBoxLayout{group};
-                const auto infoText = i18n("OpenPGP key pairs are certified by confirming the fingerprint of the public key.");
-                auto label = new QLabel{infoText, parent};
-                label->setWordWrap(true);
-                groupLayout->addWidget(label);
-                openpgpButton = new QPushButton{parent};
-                openpgpButton->setText(i18n("Create a Personal OpenPGP Key Pair"));
-                openpgpButton->setAccessibleDescription(infoText);
-
-                groupLayout->addWidget(openpgpButton);
-                scrollAreaLayout->addWidget(group);
-            }
-
-            scrollAreaLayout->addWidget(new KSeparator{Qt::Horizontal, parent});
-
-            {
-                auto group = new QGroupBox{i18n("X.509"), parent};
-                group->setFlat(true);
-                auto groupLayout = new QVBoxLayout{group};
-                const auto infoText = i18n("X.509 key pairs are certified by a certification authority (CA). The generated request needs to be sent to a CA to finalize creation.");
-                auto label = new QLabel{infoText, parent};
-                label->setWordWrap(true);
-                groupLayout->addWidget(label);
-                x509Button = new QPushButton{parent};
-                x509Button->setText(i18n("Create a Personal X.509 Key Pair and Certification Request"));
-                x509Button->setAccessibleDescription(infoText);
-
-                groupLayout->addWidget(x509Button);
-                scrollAreaLayout->addWidget(group);
-            }
-
-            mainLayout->addWidget(scrollArea);
-
-            mainLayout->addStretch(1);
-
-            mainLayout->addWidget(new KSeparator{Qt::Horizontal, parent});
-
-            buttonBox = new QDialogButtonBox{QDialogButtonBox::Cancel, parent};
-            buttonBox->button(QDialogButtonBox::Cancel)->setAutoDefault(false);
-
-            mainLayout->addWidget(buttonBox);
-        }
-    } ui;
-
-public:
-    explicit Private(ChooseCertificateProtocolDialog *qq)
-        : q{qq}
-        , ui{qq}
-    {
-        q->setWindowTitle(i18nc("@title:window", "Choose Type of Key Pair"));
-
-        connect(ui.openpgpButton,  &QAbstractButton::clicked, q, [this]() {
-            protocol = GpgME::OpenPGP;
-            q->accept();
-        });
-        connect(ui.x509Button,  &QAbstractButton::clicked, q, [this]() {
-            protocol = GpgME::CMS;
-            q->accept();
-        });
-        connect(ui.buttonBox, &QDialogButtonBox::rejected, q, &QDialog::reject);
-    }
-
-private:
-    GpgME::Protocol protocol = GpgME::UnknownProtocol;
-};
-
-ChooseCertificateProtocolDialog::ChooseCertificateProtocolDialog(QWidget *parent, Qt::WindowFlags f)
-    : QDialog{parent, f}
-    , d{new Private{this}}
-{
-}
-
-ChooseCertificateProtocolDialog::~ChooseCertificateProtocolDialog() = default;
-
-GpgME::Protocol ChooseCertificateProtocolDialog::protocol() const
-{
-    return d->protocol;
-}
-
-void ChooseCertificateProtocolDialog::showEvent(QShowEvent *event)
-{
-    // set WA_KeyboardFocusChange attribute to force visual focus of the
-    // focussed command link button when the dialog is shown (required
-    // for Breeze style and some other styles)
-    window()->setAttribute(Qt::WA_KeyboardFocusChange);
-    QDialog::showEvent(event);
-}
diff --git a/src/dialogs/choosecertificateprotocoldialog.h b/src/dialogs/choosecertificateprotocoldialog.h
deleted file mode 100644
index 1b71e6fe5..000000000
--- a/src/dialogs/choosecertificateprotocoldialog.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/* -*- mode: c++; c-basic-offset:4 -*-
-    dialogs/choosecertificateprotocoldialog.h
-
-    This file is part of Kleopatra, the KDE keymanager
-    SPDX-FileCopyrightText: 2008 Klarälvdalens Datakonsult AB
-    SPDX-FileCopyrightText: 2016, 2017 Bundesamt für Sicherheit in der Informationstechnik
-    SPDX-FileContributor: Intevation GmbH
-    SPDX-FileCopyrightText: 2022 g10 Code GmbH
-    SPDX-FileContributor: Ingo Klöcker <dev@ingo-kloecker.de>
-
-    SPDX-License-Identifier: GPL-2.0-or-later
-*/
-
-#pragma once
-
-#include <QDialog>
-
-#include <gpgme++/global.h>
-
-#include <memory>
-
-namespace Kleo
-{
-
-class ChooseCertificateProtocolDialog : public QDialog
-{
-    Q_OBJECT
-public:
-    explicit ChooseCertificateProtocolDialog(QWidget *parent = nullptr, Qt::WindowFlags f = {});
-    ~ChooseCertificateProtocolDialog() override;
-
-    GpgME::Protocol protocol() const;
-
-protected:
-    void showEvent(QShowEvent *event) override;
-
-private:
-    class Private;
-    const std::unique_ptr<Private> d;
-};
-
-}
diff --git a/src/kleopatra.rc b/src/kleopatra.rc
index 2284dfb85..72d9c47b7 100644
--- a/src/kleopatra.rc
+++ b/src/kleopatra.rc
@@ -1,141 +1,142 @@
 <!DOCTYPE gui >
-<gui name="kleopatra" version="509" >
+<gui name="kleopatra" version="510" >
     <MenuBar>
         <Menu name="file">
             <text>&amp;File</text>
             <Action name="file_new_certificate"/>
+            <Action name="file_new_certificate_signing_request"/>
             <Separator/>
             <Action name="file_lookup_certificates"/>
             <Action name="file_import_certificates"/>
             <Separator/>
             <Action name="file_export_certificates"/>
             <Action name="file_export_secret_keys"/>
             <Action name="file_export_paper_key"/>
             <Action name="file_export_certificates_to_server"/>
             <Action name="file_export_certificate_to_provider"/>
             <Separator/>
             <Action name="file_decrypt_verify_files"/>
             <Action name="file_sign_encrypt_files"/>
             <Action name="file_sign_encrypt_folder"/>
             <Separator/>
             <Action name="file_checksum_create_files"/>
             <Action name="file_checksum_verify_files"/>
             <Separator/>
             <Action name="quit" />
         </Menu>
         <Menu name="view">
             <text>&amp;View</text>
             <Action name="view_redisplay"/>
             <Separator/>
             <Action name="view_stop_operations"/>
             <Action name="view_certificate_details"/>
             <Separator/>
             <Action name="window_view_hierarchical"/>
             <Separator/>
             <Action name="window_expand_all"/>
             <Action name="window_collapse_all"/>
             <Separator/>
             <Action name="view_certificate_overview"/>
             <Action name="pad_view"/>
             <Action name="manage_smartcard"/>
         </Menu>
         <Menu name="certMenu">
             <text>&amp;Certificates</text>
             <Action name="certificates_change_owner_trust"/>
             <Action name="certificates_trust_root"/>
             <Action name="certificates_distrust_root"/>
             <Separator/>
             <Action name="certificates_certify_certificate"/>
             <Action name="certificates_revoke_certification"/>
             <Separator/>
             <Action name="certificates_change_expiry"/>
             <Action name="certificates_change_passphrase"/>
             <Action name="certificates_add_userid"/>
             <Separator/>
             <Action name="certificates_revoke"/>
             <Action name="certificates_delete"/>
         </Menu>
         <Menu name="tools">
             <text>&amp;Tools</text>
             <Action name="tools_start_kwatchgnupg"/>
             <Separator/>
             <Action name="tools_refresh_x509_certificates"/>
             <Action name="tools_refresh_openpgp_certificates"/>
             <Separator/>
             <Action name="clipboard_menu"/>
             <Separator/>
             <Action name="crl_import_crl"/>
             <Separator/>
             <Action name="crl_clear_crl_cache"/>
             <Action name="crl_dump_crl_cache"/>
             <Separator/>
             <Action name="tools_restart_backend"/>
         </Menu>
         <Menu name="settings">
             <text>&amp;Settings</text>
             <Action name="settings_self_test"/>
             <Action name="configure_groups" append="configure_merge"/>
         </Menu>
         <Menu name="window" append="settings_merge">
             <text>&amp;Window</text>
             <Action name="window_rename_tab"/>
             <Separator/>
             <Action name="window_new_tab"/>
             <Action name="window_duplicate_tab"/>
             <Action name="window_close_tab"/>
             <Separator/>
             <Action name="window_move_tab_left"/>
             <Action name="window_move_tab_right"/>
         </Menu>
         <Menu name="help">
             <text>&amp;Help</text>
             <Action name="help_doc_quickguide"/>
             <Action name="help_doc_compendium"/>
             <Action name="help_doc_symenc"/>
             <Action name="help_doc_vsa10573"/>
             <Action name="help_doc_vsa10584"/>
             <Separator/>
             <Action name="help_check_updates"/>
         </Menu>
     </MenuBar>
 
     <ToolBar fullWidth="false" name="mainToolBar" iconText="TextUnderIcon">
         <text>Main Toolbar</text>
         <Action name="file_sign_encrypt_files"/>
         <Action name="file_decrypt_verify_files"/>
         <Separator/>
         <Action name="file_import_certificates"/>
         <Action name="file_export_certificates"/>
         <Action name="certificates_certify_certificate"/>
         <Action name="file_lookup_certificates"/>
         <Separator/>
         <Action name="view_certificate_overview"/>
         <Action name="pad_view"/>
         <Action name="manage_smartcard"/>
     </ToolBar>
 
     <Menu name="listview_popup">
         <text>&amp;Certificates</text>
         <Action name="certificates_certify_certificate"/>
         <Action name="certificates_revoke_certification"/>
         <Action name="certificates_trust_root"/>
         <Action name="certificates_distrust_root"/>
         <Action name="certificates_change_owner_trust"/>
         <Separator/>
         <Action name="certificates_change_expiry"/>
         <Action name="certificates_change_passphrase"/>
         <Action name="certificates_add_userid"/>
         <Separator/>
         <Action name="certificates_revoke"/>
         <Action name="certificates_delete"/>
         <Separator/>
         <Action name="file_export_certificates"/>
         <Action name="file_export_secret_keys"/>
         <Action name="file_export_paper_key"/>
         <Action name="file_export_certificates_to_server"/>
         <Action name="file_export_certificate_to_provider"/>
         <Separator/>
         <Action name="view_certificate_details"/>
     </Menu>
 
 </gui>
diff --git a/src/kleopatraapplication.cpp b/src/kleopatraapplication.cpp
index 3cd82ff2e..717d99dea 100644
--- a/src/kleopatraapplication.cpp
+++ b/src/kleopatraapplication.cpp
@@ -1,816 +1,815 @@
 /*
     kleopatraapplication.cpp
 
     This file is part of Kleopatra, the KDE keymanager
     SPDX-FileCopyrightText: 2008 Klarälvdalens Datakonsult AB
 
     SPDX-FileCopyrightText: 2016 Bundesamt für Sicherheit in der Informationstechnik
     SPDX-FileContributor: Intevation GmbH
 
     SPDX-License-Identifier: GPL-2.0-or-later
 */
 
 #include <config-kleopatra.h>
 
 #include "kleopatraapplication.h"
 
 #include "mainwindow.h"
 #include "kleopatra_options.h"
 #include "systrayicon.h"
 #include "settings.h"
 #include "smimevalidationpreferences.h"
 
 #include <smartcard/readerstatus.h>
 #include <conf/configuredialog.h>
 
 #include <Libkleo/GnuPG>
 #include <utils/kdpipeiodevice.h>
 #include <utils/log.h>
 
 #include <gpgme++/key.h>
 
 #include <Libkleo/Dn>
 #include <Libkleo/FileSystemWatcher>
 #include <Libkleo/KeyCache>
 #include <Libkleo/KeyFilterManager>
 #include <Libkleo/KeyGroupConfig>
 #include <Libkleo/Classify>
 
 #ifdef HAVE_USABLE_ASSUAN
 # include <uiserver/uiserver.h>
 #endif
 
 #include "commands/signencryptfilescommand.h"
 #include "commands/decryptverifyfilescommand.h"
 #include "commands/lookupcertificatescommand.h"
 #include "commands/checksumcreatefilescommand.h"
 #include "commands/checksumverifyfilescommand.h"
 #include "commands/detailscommand.h"
 #include "commands/newcertificatecommand.h"
 #include "commands/newopenpgpcertificatecommand.h"
 
 #include "dialogs/updatenotification.h"
 
 #include <KIconLoader>
 #include <KLocalizedString>
 #include "kleopatra_debug.h"
 #include <KMessageBox>
 #include <KWindowSystem>
 
 #include <QDesktopServices>
 #include <QFile>
 #include <QDir>
 #include <QFocusFrame>
 #if QT_CONFIG(graphicseffect)
 #include <QGraphicsEffect>
 #endif
 #include <QPointer>
 #include <QStyleOption>
 #include <QStylePainter>
 
 #include <memory>
 #include <KSharedConfig>
 
 
 #ifdef Q_OS_WIN
 #include <QtPlatformHeaders/QWindowsWindowFunctions>
 #endif
 
 using namespace Kleo;
 using namespace Kleo::Commands;
 
 static void add_resources()
 {
     KIconLoader::global()->addAppDir(QStringLiteral("libkleopatra"));
     KIconLoader::global()->addAppDir(QStringLiteral("kwatchgnupg"));
 }
 
 static QList<QByteArray> default_logging_options()
 {
     QList<QByteArray> result;
     result.push_back("io");
     return result;
 }
 
 namespace
 {
 class FocusFrame : public QFocusFrame
 {
     Q_OBJECT
 public:
     using QFocusFrame::QFocusFrame;
 
 protected:
     void paintEvent(QPaintEvent *event) override;
 };
 
 static QRect effectiveWidgetRect(const QWidget *w)
 {
     // based on QWidgetPrivate::effectiveRectFor
 #if QT_CONFIG(graphicseffect)
     if (auto graphicsEffect = w->graphicsEffect(); graphicsEffect && graphicsEffect->isEnabled())
         return graphicsEffect->boundingRectFor(w->rect()).toAlignedRect();
 #endif // QT_CONFIG(graphicseffect)
     return w->rect();
 }
 
 static QRect clipRect(const QWidget *w)
 {
     // based on QWidgetPrivate::clipRect
     if (!w->isVisible()) {
         return QRect();
     }
     QRect r = effectiveWidgetRect(w);
     int ox = 0;
     int oy = 0;
     while (w && w->isVisible() && !w->isWindow() && w->parentWidget()) {
         ox -= w->x();
         oy -= w->y();
         w = w->parentWidget();
         r &= QRect(ox, oy, w->width(), w->height());
     }
     return r;
 }
 
 void FocusFrame::paintEvent(QPaintEvent *)
 {
     if (!widget()) {
         return;
     }
 
     QStylePainter p(this);
     QStyleOptionFocusRect option;
     initStyleOption(&option);
     const int vmargin = style()->pixelMetric(QStyle::PM_FocusFrameVMargin, &option);
     const int hmargin = style()->pixelMetric(QStyle::PM_FocusFrameHMargin, &option);
     const QRect rect = clipRect(widget()).adjusted(0, 0, hmargin*2, vmargin*2);
     p.setClipRect(rect);
     p.drawPrimitive(QStyle::PE_FrameFocusRect, option);
 }
 }
 
 class KleopatraApplication::Private
 {
     friend class ::KleopatraApplication;
     KleopatraApplication *const q;
 public:
     explicit Private(KleopatraApplication *qq)
         : q(qq)
         , ignoreNewInstance(true)
         , firstNewInstance(true)
         , sysTray(nullptr)
         , groupConfig{std::make_shared<KeyGroupConfig>(QStringLiteral("kleopatragroupsrc"))}
     {
     }
     ~Private() {
 #ifndef QT_NO_SYSTEMTRAYICON
         delete sysTray;
 #endif
     }
     void setUpSysTrayIcon()
     {
         KDAB_SET_OBJECT_NAME(readerStatus);
 #ifndef QT_NO_SYSTEMTRAYICON
         sysTray = new SysTrayIcon();
         sysTray->setFirstCardWithNullPin(readerStatus.firstCardWithNullPin());
         sysTray->setAnyCardCanLearnKeys(readerStatus.anyCardCanLearnKeys());
 
         connect(&readerStatus, &SmartCard::ReaderStatus::firstCardWithNullPinChanged,
                 sysTray, &SysTrayIcon::setFirstCardWithNullPin);
         connect(&readerStatus, &SmartCard::ReaderStatus::anyCardCanLearnKeysChanged,
                 sysTray, &SysTrayIcon::setAnyCardCanLearnKeys);
 #endif
     }
 
 private:
     void connectConfigureDialog()
     {
         if (configureDialog) {
             if (q->mainWindow()) {
                 connect(configureDialog, SIGNAL(configCommitted()),
                         q->mainWindow(), SLOT(slotConfigCommitted()));
             }
             connect(configureDialog, &ConfigureDialog::configCommitted,
                     q, &KleopatraApplication::configurationChanged);
         }
     }
     void disconnectConfigureDialog()
     {
         if (configureDialog) {
             if (q->mainWindow()) {
                 disconnect(configureDialog, SIGNAL(configCommitted()),
                            q->mainWindow(), SLOT(slotConfigCommitted()));
             }
             disconnect(configureDialog, &ConfigureDialog::configCommitted,
                        q, &KleopatraApplication::configurationChanged);
         }
     }
 
 public:
     bool ignoreNewInstance;
     bool firstNewInstance;
     QPointer<FocusFrame> focusFrame;
     QPointer<ConfigureDialog> configureDialog;
     QPointer<MainWindow> mainWindow;
     SmartCard::ReaderStatus readerStatus;
 #ifndef QT_NO_SYSTEMTRAYICON
     SysTrayIcon *sysTray;
 #endif
     std::shared_ptr<KeyGroupConfig> groupConfig;
     std::shared_ptr<KeyCache> keyCache;
     std::shared_ptr<Log> log;
     std::shared_ptr<FileSystemWatcher> watcher;
 
 public:
     void setupKeyCache()
     {
         keyCache = KeyCache::mutableInstance();
         keyCache->setRefreshInterval(SMimeValidationPreferences{}.refreshInterval());
         watcher.reset(new FileSystemWatcher);
 
         watcher->whitelistFiles(gnupgFileWhitelist());
         watcher->addPaths(gnupgFolderWhitelist());
         watcher->setDelay(1000);
         keyCache->addFileSystemWatcher(watcher);
         keyCache->setGroupConfig(groupConfig);
         keyCache->setGroupsEnabled(Settings().groupsEnabled());
     }
 
     void setUpFilterManager()
     {
         if (!Settings{}.cmsEnabled()) {
             KeyFilterManager::instance()->alwaysFilterByProtocol(GpgME::OpenPGP);
         }
     }
 
     void setupLogging()
     {
         log = Log::mutableInstance();
 
         const QByteArray envOptions = qgetenv("KLEOPATRA_LOGOPTIONS");
         const bool logAll = envOptions.trimmed() == "all";
         const QList<QByteArray> options = envOptions.isEmpty() ? default_logging_options() : envOptions.split(',');
 
         const QByteArray dirNative = qgetenv("KLEOPATRA_LOGDIR");
         if (dirNative.isEmpty()) {
             return;
         }
         const QString dir = QFile::decodeName(dirNative);
         const QString logFileName = QDir(dir).absoluteFilePath(QStringLiteral("kleopatra.log.%1").arg(QCoreApplication::applicationPid()));
         std::unique_ptr<QFile> logFile(new QFile(logFileName));
         if (!logFile->open(QIODevice::WriteOnly | QIODevice::Append)) {
             qCDebug(KLEOPATRA_LOG) << "Could not open file for logging: " << logFileName << "\nLogging disabled";
             return;
         }
 
         log->setOutputDirectory(dir);
         if (logAll || options.contains("io")) {
             log->setIOLoggingEnabled(true);
         }
         qInstallMessageHandler(Log::messageHandler);
 
 #ifdef HAVE_USABLE_ASSUAN
         if (logAll || options.contains("pipeio")) {
             KDPipeIODevice::setDebugLevel(KDPipeIODevice::Debug);
         }
         UiServer::setLogStream(log->logFile());
 #endif
     }
 
     void updateFocusFrame(QWidget *focusWidget)
     {
         if (focusWidget && focusWidget->inherits("QLabel")) {
             if (!focusFrame) {
                 focusFrame = new FocusFrame{focusWidget};
             }
             focusFrame->setWidget(focusWidget);
         } else if (focusFrame) {
             focusFrame->setWidget(nullptr);
         }
     }
 };
 
 KleopatraApplication::KleopatraApplication(int &argc, char *argv[])
     : QApplication(argc, argv), d(new Private(this))
 {
     // disable parent<->child navigation in tree views with left/right arrow keys
     // because this interferes with column by column navigation that is required
     // for accessibility
     setStyleSheet(QStringLiteral("QTreeView { arrow-keys-navigate-into-children: 0; }"));
     connect(this, &QApplication::focusChanged,
             this, [this](QWidget *, QWidget *now) {
                 d->updateFocusFrame(now);
             });
 }
 
 void KleopatraApplication::init()
 {
 #ifdef Q_OS_WIN
     QWindowsWindowFunctions::setWindowActivationBehavior(
             QWindowsWindowFunctions::AlwaysActivateWindow);
 #endif
     const auto blockedUrlSchemes = Settings{}.blockedUrlSchemes();
     for (const auto &scheme : blockedUrlSchemes) {
         QDesktopServices::setUrlHandler(scheme, this, "blockUrl");
     }
     add_resources();
     DN::setAttributeOrder(Settings{}.attributeOrder());
     /* Start the gpg-agent early, this is done explicitly
      * because on an empty keyring our keylistings wont start
      * the agent. In that case any assuan-connect calls to
      * the agent will fail. The requested start via the
      * connection is additionally done in case the gpg-agent
      * is killed while Kleopatra is running. */
     startGpgAgent();
     connect(&d->readerStatus, &SmartCard::ReaderStatus::startOfGpgAgentRequested,
             this, &KleopatraApplication::startGpgAgent);
     d->setupKeyCache();
     d->setUpSysTrayIcon();
     d->setUpFilterManager();
     d->setupLogging();
 #ifndef QT_NO_SYSTEMTRAYICON
     d->sysTray->show();
 #endif
     setQuitOnLastWindowClosed(false);
     KWindowSystem::allowExternalProcessWindowActivation();
 }
 
 KleopatraApplication::~KleopatraApplication()
 {
     // main window doesn't receive "close" signal and cannot
     // save settings before app exit
     delete d->mainWindow;
 
     // work around kdelibs bug https://bugs.kde.org/show_bug.cgi?id=162514
     KSharedConfig::openConfig()->sync();
 }
 
 namespace
 {
 using Func = void (KleopatraApplication::*)(const QStringList &, GpgME::Protocol);
 }
 
 void KleopatraApplication::slotActivateRequested(const QStringList &arguments,
         const QString &workingDirectory)
 {
     QCommandLineParser parser;
 
     kleopatra_options(&parser);
     QString err;
     if (!arguments.isEmpty() && !parser.parse(arguments)) {
         err = parser.errorText();
     } else if (arguments.isEmpty()) {
         // KDBusServices omits the application name if no other
         // arguments are provided. In that case the parser prints
         // a warning.
         parser.parse(QStringList() << QCoreApplication::applicationFilePath());
     }
 
     if (err.isEmpty()) {
         err = newInstance(parser, workingDirectory);
     }
 
     if (!err.isEmpty()) {
         KMessageBox::error(nullptr, err.toHtmlEscaped(), i18n("Failed to execute command"));
         Q_EMIT setExitValue(1);
         return;
     }
     Q_EMIT setExitValue(0);
 }
 
 QString KleopatraApplication::newInstance(const QCommandLineParser &parser,
         const QString &workingDirectory)
 {
     if (d->ignoreNewInstance) {
         qCDebug(KLEOPATRA_LOG) << "New instance ignored because of ignoreNewInstance";
         return QString();
     }
 
     QStringList files;
     const QDir cwd = QDir(workingDirectory);
     bool queryMode = parser.isSet(QStringLiteral("query")) || parser.isSet(QStringLiteral("search"));
 
     // Query and Search treat positional arguments differently, see below.
     if (!queryMode) {
         const auto positionalArguments = parser.positionalArguments();
         for (const QString &file : positionalArguments) {
             // We do not check that file exists here. Better handle
             // these errors in the UI.
             if (QFileInfo(file).isAbsolute()) {
                 files << file;
             } else {
                 files << cwd.absoluteFilePath(file);
             }
         }
     }
 
     GpgME::Protocol protocol = GpgME::UnknownProtocol;
 
     if (parser.isSet(QStringLiteral("openpgp"))) {
         qCDebug(KLEOPATRA_LOG) << "found OpenPGP";
         protocol = GpgME::OpenPGP;
     }
 
     if (parser.isSet(QStringLiteral("cms"))) {
         qCDebug(KLEOPATRA_LOG) << "found CMS";
         if (protocol == GpgME::OpenPGP) {
             return i18n("Ambiguous protocol: --openpgp and --cms");
         }
         protocol = GpgME::CMS;
     }
 
     // Check for Parent Window id
     WId parentId = 0;
     if (parser.isSet(QStringLiteral("parent-windowid"))) {
 #ifdef Q_OS_WIN
         // WId is not a portable type as it is a pointer type on Windows.
         // casting it from an integer is ok though as the values are guaranteed to
         // be compatible in the documentation.
         parentId = reinterpret_cast<WId>(parser.value(QStringLiteral("parent-windowid")).toUInt());
 #else
         parentId = parser.value(QStringLiteral("parent-windowid")).toUInt();
 #endif
     }
 
     // Handle openpgp4fpr URI scheme
     QString needle;
     if (queryMode) {
         needle = parser.positionalArguments().join(QLatin1Char(' '));
     }
     if (needle.startsWith(QLatin1String("openpgp4fpr:"))) {
         needle.remove(0, 12);
     }
 
     // Check for --search command.
     if (parser.isSet(QStringLiteral("search"))) {
         // This is an extra command instead of a combination with the
         // similar query to avoid changing the older query commands behavior
         // and query's "show details if a certificate exist or search on a
         // keyserver" logic is hard to explain and use consistently.
         if (needle.isEmpty()) {
             return i18n("No search string specified for --search");
         }
         auto const cmd = new LookupCertificatesCommand(needle, nullptr);
         cmd->setParentWId(parentId);
         cmd->start();
         return QString();
     }
 
     // Check for --query command
     if (parser.isSet(QStringLiteral("query"))) {
         if (needle.isEmpty()) {
             return i18n("No fingerprint argument specified for --query");
         }
         auto cmd = Command::commandForQuery(needle);
         cmd->setParentWId(parentId);
         cmd->start();
         return QString();
     }
 
     // Check for --gen-key command
     if (parser.isSet(QStringLiteral("gen-key"))) {
         if (protocol == GpgME::CMS) {
             const Kleo::Settings settings{};
             if (settings.cmsEnabled() && settings.cmsCertificateCreationAllowed()) {
                 auto cmd = new NewCertificateCommand(nullptr);
                 cmd->setParentWId(parentId);
-                cmd->setProtocol(protocol);
                 cmd->start();
             } else {
                 return i18n("You are not allowed to create S/MIME certificate signing requests.");
             }
         } else {
             auto cmd = new NewOpenPGPCertificateCommand;
             cmd->setParentWId(parentId);
             cmd->start();
         }
         return QString();
     }
 
     // Check for --config command
     if (parser.isSet(QStringLiteral("config"))) {
         openConfigDialogWithForeignParent(parentId);
         return QString();
     }
 
     struct FuncInfo {
         QString optionName;
         Func func;
     };
     static const std::vector<FuncInfo> funcMap {
         { QStringLiteral("import-certificate"), &KleopatraApplication::importCertificatesFromFile },
         { QStringLiteral("encrypt"), &KleopatraApplication::encryptFiles },
         { QStringLiteral("sign"), &KleopatraApplication::signFiles },
         { QStringLiteral("encrypt-sign"), &KleopatraApplication::signEncryptFiles },
         { QStringLiteral("sign-encrypt"), &KleopatraApplication::signEncryptFiles },
         { QStringLiteral("decrypt"), &KleopatraApplication::decryptFiles },
         { QStringLiteral("verify"), &KleopatraApplication::verifyFiles },
         { QStringLiteral("decrypt-verify"), &KleopatraApplication::decryptVerifyFiles },
         { QStringLiteral("checksum"), &KleopatraApplication::checksumFiles },
     };
 
     QString found;
     Func foundFunc = nullptr;
     for (const auto &[opt, fn] : funcMap) {
         if (parser.isSet(opt) && found.isEmpty()) {
             found = opt;
             foundFunc = fn;
         } else if (parser.isSet(opt)) {
             return i18n(R"(Ambiguous commands "%1" and "%2")", found, opt);
         }
     }
 
     QStringList errors;
     if (!found.isEmpty()) {
         if (files.empty()) {
             return i18n("No files specified for \"%1\" command", found);
         }
         qCDebug(KLEOPATRA_LOG) << "found" << found;
         (this->*foundFunc)(files, protocol);
     } else {
         if (files.empty()) {
             if (!(d->firstNewInstance && isSessionRestored())) {
                 qCDebug(KLEOPATRA_LOG) << "openOrRaiseMainWindow";
                 openOrRaiseMainWindow();
             }
         } else {
             for (const QString& fileName : std::as_const(files)) {
                 QFileInfo fi(fileName);
                 if (!fi.isReadable()) {
                     errors << i18n("Cannot read \"%1\"", fileName);
                 }
             }
             const QVector<Command *> allCmds = Command::commandsForFiles(files);
             for (Command *cmd : allCmds) {
                 if (parentId) {
                     cmd->setParentWId(parentId);
                 } else {
                     MainWindow *mw = mainWindow();
                     if (!mw) {
                         mw = new MainWindow;
                         mw->setAttribute(Qt::WA_DeleteOnClose);
                         setMainWindow(mw);
                         d->connectConfigureDialog();
                     }
                     cmd->setParentWidget(mw);
                 }
                 cmd->start();
             }
         }
     }
     d->firstNewInstance = false;
 
 #ifdef Q_OS_WIN
     // On Windows we might be started from the
     // explorer in any working directory. E.g.
     // a double click on a file. To avoid preventing
     // the folder from deletion we set the
     // working directory to the users homedir.
     QDir::setCurrent(QDir::homePath());
 #endif
 
     return errors.join(QLatin1Char('\n'));
 }
 
 #ifndef QT_NO_SYSTEMTRAYICON
 const SysTrayIcon *KleopatraApplication::sysTrayIcon() const
 {
     return d->sysTray;
 }
 
 SysTrayIcon *KleopatraApplication::sysTrayIcon()
 {
     return d->sysTray;
 }
 #endif
 
 const MainWindow *KleopatraApplication::mainWindow() const
 {
     return d->mainWindow;
 }
 
 MainWindow *KleopatraApplication::mainWindow()
 {
     return d->mainWindow;
 }
 
 void KleopatraApplication::setMainWindow(MainWindow *mainWindow)
 {
     if (mainWindow == d->mainWindow) {
         return;
     }
 
     d->disconnectConfigureDialog();
 
     d->mainWindow = mainWindow;
 #ifndef QT_NO_SYSTEMTRAYICON
     d->sysTray->setMainWindow(mainWindow);
 #endif
 
     d->connectConfigureDialog();
 }
 
 static void open_or_raise(QWidget *w)
 {
     if (w->isMinimized()) {
         KWindowSystem::unminimizeWindow(w->winId());
         w->raise();
     } else if (w->isVisible()) {
         w->raise();
     } else {
         w->show();
     }
 }
 
 void KleopatraApplication::toggleMainWindowVisibility()
 {
     if (mainWindow()) {
         mainWindow()->setVisible(!mainWindow()->isVisible());
     } else {
         openOrRaiseMainWindow();
     }
 }
 
 void KleopatraApplication::restoreMainWindow()
 {
     qCDebug(KLEOPATRA_LOG) << "restoring main window";
 
     // Sanity checks
     if (!isSessionRestored()) {
         qCDebug(KLEOPATRA_LOG) << "Not in session restore";
         return;
     }
 
     if (mainWindow()) {
         qCDebug(KLEOPATRA_LOG) << "Already have main window";
         return;
     }
 
     auto mw = new MainWindow;
     if (KMainWindow::canBeRestored(1)) {
         // restore to hidden state, Mainwindow::readProperties() will
         // restore saved visibility.
         mw->restore(1, false);
     }
 
     mw->setAttribute(Qt::WA_DeleteOnClose);
     setMainWindow(mw);
     d->connectConfigureDialog();
 
 }
 
 void KleopatraApplication::openOrRaiseMainWindow()
 {
     MainWindow *mw = mainWindow();
     if (!mw) {
         mw = new MainWindow;
         mw->setAttribute(Qt::WA_DeleteOnClose);
         setMainWindow(mw);
         d->connectConfigureDialog();
     }
     open_or_raise(mw);
     UpdateNotification::checkUpdate(mw);
 }
 
 void KleopatraApplication::openConfigDialogWithForeignParent(WId parentWId)
 {
     if (!d->configureDialog) {
         d->configureDialog = new ConfigureDialog;
         d->configureDialog->setAttribute(Qt::WA_DeleteOnClose);
         d->connectConfigureDialog();
     }
 
     // This is similar to what the commands do.
     if (parentWId) {
         if (QWidget *pw = QWidget::find(parentWId)) {
             d->configureDialog->setParent(pw, d->configureDialog->windowFlags());
         } else {
             d->configureDialog->setAttribute(Qt::WA_NativeWindow, true);
             KWindowSystem::setMainWindow(d->configureDialog->windowHandle(), parentWId);
         }
     }
 
     open_or_raise(d->configureDialog);
 
     // If we have a parent we want to raise over it.
     if (parentWId) {
         d->configureDialog->raise();
     }
 }
 
 void KleopatraApplication::openOrRaiseConfigDialog()
 {
     openConfigDialogWithForeignParent(0);
 }
 
 #ifndef QT_NO_SYSTEMTRAYICON
 void KleopatraApplication::startMonitoringSmartCard()
 {
     d->readerStatus.startMonitoring();
 }
 #endif // QT_NO_SYSTEMTRAYICON
 
 void KleopatraApplication::importCertificatesFromFile(const QStringList &files, GpgME::Protocol /*proto*/)
 {
     openOrRaiseMainWindow();
     if (!files.empty()) {
         mainWindow()->importCertificatesFromFile(files);
     }
 }
 
 void KleopatraApplication::encryptFiles(const QStringList &files, GpgME::Protocol proto)
 {
     auto const cmd = new SignEncryptFilesCommand(files, nullptr);
     cmd->setEncryptionPolicy(Force);
     cmd->setSigningPolicy(Allow);
     if (proto != GpgME::UnknownProtocol) {
         cmd->setProtocol(proto);
     }
     cmd->start();
 }
 
 void KleopatraApplication::signFiles(const QStringList &files, GpgME::Protocol proto)
 {
     auto const cmd = new SignEncryptFilesCommand(files, nullptr);
     cmd->setSigningPolicy(Force);
     cmd->setEncryptionPolicy(Deny);
     if (proto != GpgME::UnknownProtocol) {
         cmd->setProtocol(proto);
     }
     cmd->start();
 }
 
 void KleopatraApplication::signEncryptFiles(const QStringList &files, GpgME::Protocol proto)
 {
     auto const cmd = new SignEncryptFilesCommand(files, nullptr);
     if (proto != GpgME::UnknownProtocol) {
         cmd->setProtocol(proto);
     }
     cmd->start();
 }
 
 void KleopatraApplication::decryptFiles(const QStringList &files, GpgME::Protocol /*proto*/)
 {
     auto const cmd = new DecryptVerifyFilesCommand(files, nullptr);
     cmd->setOperation(Decrypt);
     cmd->start();
 }
 
 void KleopatraApplication::verifyFiles(const QStringList &files, GpgME::Protocol /*proto*/)
 {
     auto const cmd = new DecryptVerifyFilesCommand(files, nullptr);
     cmd->setOperation(Verify);
     cmd->start();
 }
 
 void KleopatraApplication::decryptVerifyFiles(const QStringList &files, GpgME::Protocol /*proto*/)
 {
     auto const cmd = new DecryptVerifyFilesCommand(files, nullptr);
     cmd->start();
 }
 
 void KleopatraApplication::checksumFiles(const QStringList &files, GpgME::Protocol /*proto*/)
 {
     QStringList verifyFiles, createFiles;
 
     for (const QString &file : files) {
         if (isChecksumFile(file)) {
             verifyFiles << file;
         } else {
             createFiles << file;
         }
     }
 
     if (!verifyFiles.isEmpty()) {
         auto const cmd = new ChecksumVerifyFilesCommand(verifyFiles, nullptr);
         cmd->start();
     }
     if (!createFiles.isEmpty()) {
         auto const cmd = new ChecksumCreateFilesCommand(createFiles, nullptr);
         cmd->start();
     }
 }
 
 void KleopatraApplication::setIgnoreNewInstance(bool ignore)
 {
     d->ignoreNewInstance = ignore;
 }
 
 bool KleopatraApplication::ignoreNewInstance() const
 {
     return d->ignoreNewInstance;
 }
 
 void KleopatraApplication::blockUrl(const QUrl &url)
 {
     qCDebug(KLEOPATRA_LOG) << "Blocking URL" << url;
     KMessageBox::error(mainWindow(),i18n ("Opening an external link is administratively prohibited."),
                 i18n ("Prohibited"));
 }
 
 void KleopatraApplication::startGpgAgent()
 {
     Kleo::launchGpgAgent();
 }
 
 #include "kleopatraapplication.moc"
diff --git a/src/view/keylistcontroller.cpp b/src/view/keylistcontroller.cpp
index 8becf0d2f..ac850608b 100644
--- a/src/view/keylistcontroller.cpp
+++ b/src/view/keylistcontroller.cpp
@@ -1,853 +1,863 @@
 /* -*- mode: c++; c-basic-offset:4 -*-
     controllers/keylistcontroller.cpp
 
     This file is part of Kleopatra, the KDE keymanager
     SPDX-FileCopyrightText: 2007 Klarälvdalens Datakonsult AB
     SPDX-FileCopyrightText: 2022 Felix Tiede
 
     SPDX-License-Identifier: GPL-2.0-or-later
 */
 
 #include <config-kleopatra.h>
 
 #include "keylistcontroller.h"
 #include "tabwidget.h"
 
 #include <smartcard/readerstatus.h>
 
 #include <utils/action_data.h>
 
 #include <settings.h>
 #include "tooltippreferences.h"
 #include "kleopatra_debug.h"
 #include "commands/exportcertificatecommand.h"
 #include "commands/exportopenpgpcertstoservercommand.h"
 #ifdef MAILAKONADI_ENABLED
 #include "commands/exportopenpgpcerttoprovidercommand.h"
 #endif // MAILAKONADI_ENABLED
 #ifdef QGPGME_SUPPORTS_SECRET_KEY_EXPORT
 # include "commands/exportsecretkeycommand.h"
 #else
 # include "commands/exportsecretkeycommand_old.h"
 #endif
 #include "commands/importcertificatefromfilecommand.h"
 #include "commands/changepassphrasecommand.h"
 #include "commands/lookupcertificatescommand.h"
 #include "commands/reloadkeyscommand.h"
 #include "commands/refreshx509certscommand.h"
 #include "commands/refreshopenpgpcertscommand.h"
 #include "commands/detailscommand.h"
 #include "commands/deletecertificatescommand.h"
 #include "commands/decryptverifyfilescommand.h"
 #include "commands/signencryptfilescommand.h"
 #include "commands/signencryptfoldercommand.h"
 #include "commands/clearcrlcachecommand.h"
 #include "commands/dumpcrlcachecommand.h"
 #include "commands/dumpcertificatecommand.h"
 #include "commands/importcrlcommand.h"
 #include "commands/changeexpirycommand.h"
 #include "commands/changeownertrustcommand.h"
 #include "commands/changeroottrustcommand.h"
 #include "commands/certifycertificatecommand.h"
 #include "commands/revokecertificationcommand.h"
 #include "commands/adduseridcommand.h"
 #include "commands/newcertificatecommand.h"
+#include "commands/newopenpgpcertificatecommand.h"
 #include "commands/checksumverifyfilescommand.h"
 #include "commands/checksumcreatefilescommand.h"
 #include "commands/exportpaperkeycommand.h"
 #include "commands/revokekeycommand.h"
 
 #include <Libkleo/KeyCache>
 #include <Libkleo/KeyListModel>
 #include <Libkleo/Formatting>
 
 #include <gpgme++/key.h>
 
 #include <KActionCollection>
 #include <KLocalizedString>
 
 #include <QAbstractItemView>
 #include <QPointer>
 #include <QItemSelectionModel>
 #include <QAction>
 
 #include <algorithm>
 #include <iterator>
 
 // needed for GPGME_VERSION_NUMBER
 #include <gpgme.h>
 
 using namespace Kleo;
 using namespace Kleo::Commands;
 using namespace Kleo::SmartCard;
 using namespace GpgME;
 #ifndef QGPGME_SUPPORTS_SECRET_KEY_EXPORT
 using Kleo::Commands::Compat::ExportSecretKeyCommand;
 #endif
 
 class KeyListController::Private
 {
     friend class ::Kleo::KeyListController;
     KeyListController *const q;
 public:
     explicit Private(KeyListController *qq);
     ~Private();
 
     void connectView(QAbstractItemView *view);
     void connectCommand(Command *cmd);
 
     void connectTabWidget();
     void disconnectTabWidget();
 
     void addCommand(Command *cmd)
     {
         connectCommand(cmd);
         commands.insert(std::lower_bound(commands.begin(), commands.end(), cmd), cmd);
     }
     void addView(QAbstractItemView *view)
     {
         connectView(view);
         views.insert(std::lower_bound(views.begin(), views.end(), view), view);
     }
     void removeView(QAbstractItemView *view)
     {
         view->disconnect(q);
         view->selectionModel()->disconnect(q);
         views.erase(std::remove(views.begin(), views.end(), view), views.end());
     }
 
 public:
     void slotDestroyed(QObject *o)
     {
         qCDebug(KLEOPATRA_LOG) << (void *)o;
         views.erase(std::remove(views.begin(), views.end(), o), views.end());
         commands.erase(std::remove(commands.begin(), commands.end(), o), commands.end());
     }
     void slotDoubleClicked(const QModelIndex &idx);
     void slotActivated(const QModelIndex &idx);
     void slotSelectionChanged(const QItemSelection &old, const QItemSelection &new_);
     void slotContextMenu(const QPoint &pos);
     void slotCommandFinished();
     void slotAddKey(const Key &key);
     void slotAboutToRemoveKey(const Key &key);
     void slotProgress(const QString &what, int current, int total)
     {
         Q_EMIT q->progress(current, total);
         if (!what.isEmpty()) {
             Q_EMIT q->message(what);
         }
     }
     void slotActionTriggered(QAction *action);
     void slotCurrentViewChanged(QAbstractItemView *view)
     {
         if (view && !std::binary_search(views.cbegin(), views.cend(), view)) {
             qCDebug(KLEOPATRA_LOG) << "you need to register view" << view << "before trying to set it as the current view!";
             addView(view);
         }
         currentView = view;
         q->enableDisableActions(view ? view->selectionModel() : nullptr);
     }
 
 private:
     int toolTipOptions() const;
 
 private:
     static Command::Restrictions calculateRestrictionsMask(const QItemSelectionModel *sm);
 
 private:
     struct action_item {
         QPointer<QAction> action;
         Command::Restrictions restrictions;
         Command *(*createCommand)(QAbstractItemView *, KeyListController *);
     };
     std::vector<action_item> actions;
     std::vector<QAbstractItemView *> views;
     std::vector<Command *> commands;
     QPointer<QWidget> parentWidget;
     QPointer<TabWidget> tabWidget;
     QPointer<QAbstractItemView> currentView;
     QPointer<AbstractKeyListModel> flatModel, hierarchicalModel;
     std::vector<QMetaObject::Connection> m_connections;
 };
 
 KeyListController::Private::Private(KeyListController *qq)
     : q(qq),
       actions(),
       views(),
       commands(),
       parentWidget(),
       tabWidget(),
       flatModel(),
       hierarchicalModel()
 {
     connect(KeyCache::instance().get(), &KeyCache::added, q, [this](const GpgME::Key &key) { slotAddKey(key); });
     connect(KeyCache::instance().get(), &KeyCache::aboutToRemove, q, [this](const GpgME::Key &key) { slotAboutToRemoveKey(key); });
 }
 
 KeyListController::Private::~Private() {}
 
 KeyListController::KeyListController(QObject *p)
     : QObject(p), d(new Private(this))
 {
 
 }
 
 KeyListController::~KeyListController() {}
 
 void KeyListController::Private::slotAddKey(const Key &key)
 {
     // ### make model act on keycache directly...
     if (flatModel) {
         flatModel->addKey(key);
     }
     if (hierarchicalModel) {
         hierarchicalModel->addKey(key);
     }
 }
 
 void KeyListController::Private::slotAboutToRemoveKey(const Key &key)
 {
     // ### make model act on keycache directly...
     if (flatModel) {
         flatModel->removeKey(key);
     }
     if (hierarchicalModel) {
         hierarchicalModel->removeKey(key);
     }
 }
 
 void KeyListController::addView(QAbstractItemView *view)
 {
     if (!view || std::binary_search(d->views.cbegin(), d->views.cend(), view)) {
         return;
     }
     d->addView(view);
 }
 
 void KeyListController::removeView(QAbstractItemView *view)
 {
     if (!view || !std::binary_search(d->views.cbegin(), d->views.cend(), view)) {
         return;
     }
     d->removeView(view);
 }
 
 void KeyListController::setCurrentView(QAbstractItemView *view)
 {
     d->slotCurrentViewChanged(view);
 }
 
 std::vector<QAbstractItemView *> KeyListController::views() const
 {
     return d->views;
 }
 
 void KeyListController::setFlatModel(AbstractKeyListModel *model)
 {
     if (model == d->flatModel) {
         return;
     }
 
     d->flatModel = model;
 
     if (model) {
         model->clear();
         if (KeyCache::instance()->initialized()) {
             model->addKeys(KeyCache::instance()->keys());
         }
         model->setToolTipOptions(d->toolTipOptions());
     }
 }
 
 void KeyListController::setHierarchicalModel(AbstractKeyListModel *model)
 {
     if (model == d->hierarchicalModel) {
         return;
     }
 
     d->hierarchicalModel = model;
 
     if (model) {
         model->clear();
         if (KeyCache::instance()->initialized()) {
             model->addKeys(KeyCache::instance()->keys());
         }
         model->setToolTipOptions(d->toolTipOptions());
     }
 }
 
 void KeyListController::setTabWidget(TabWidget *tabWidget)
 {
     if (tabWidget == d->tabWidget) {
         return;
     }
 
     d->disconnectTabWidget();
 
     d->tabWidget = tabWidget;
 
     d->connectTabWidget();
 
     d->slotCurrentViewChanged(tabWidget ? tabWidget->currentView() : nullptr);
 }
 
 void KeyListController::setParentWidget(QWidget *parent)
 {
     d->parentWidget = parent;
 }
 
 QWidget *KeyListController::parentWidget() const
 {
     return d->parentWidget;
 }
 
 void KeyListController::Private::connectTabWidget()
 {
     if (!tabWidget) {
         return;
     }
     const auto views = tabWidget->views();
     std::for_each(views.cbegin(), views.cend(),
                   [this](QAbstractItemView *view) { addView(view); });
 
     m_connections.reserve(3);
     m_connections.push_back(connect(tabWidget, &TabWidget::viewAdded, q, &KeyListController::addView));
     m_connections.push_back(connect(tabWidget, &TabWidget::viewAboutToBeRemoved, q, &KeyListController::removeView));
     m_connections.push_back(connect(tabWidget, &TabWidget::currentViewChanged, q, [this](QAbstractItemView *view) { slotCurrentViewChanged(view); }));
 }
 
 void KeyListController::Private::disconnectTabWidget()
 {
     if (!tabWidget) {
         return;
     }
     for (const auto &connection : m_connections) {
         disconnect(connection);
     }
     m_connections.clear();
 
     const auto views = tabWidget->views();
     std::for_each(views.cbegin(), views.cend(),
                   [this](QAbstractItemView *view) { removeView(view); });
 }
 
 AbstractKeyListModel *KeyListController::flatModel() const
 {
     return d->flatModel;
 }
 
 AbstractKeyListModel *KeyListController::hierarchicalModel() const
 {
     return d->hierarchicalModel;
 }
 
 QAbstractItemView *KeyListController::currentView() const
 {
     return d->currentView;
 }
 
 TabWidget *KeyListController::tabWidget() const
 {
     return d->tabWidget;
 }
 
 void KeyListController::createActions(KActionCollection *coll)
 {
     const std::vector<action_data> common_and_openpgp_action_data = {
         // File menu
         {
-            "file_new_certificate", i18n("New Key Pair..."), QString(),
+            "file_new_certificate", i18n("New OpenPGP Key Pair..."), i18n("Create a new OpenPGP certificate"),
             "view-certificate-add", nullptr, nullptr, QStringLiteral("Ctrl+N")
         },
         {
             "file_export_certificates", i18n("Export..."), i18n("Export the selected certificate (public key) to a file"),
             "view-certificate-export", nullptr, nullptr, QStringLiteral("Ctrl+E")
         },
         {
             "file_export_certificates_to_server", i18n("Publish on Server..."), i18n("Publish the selected certificate (public key) on a public keyserver"),
             "view-certificate-export-server", nullptr, nullptr, QStringLiteral("Ctrl+Shift+E")
         },
 #ifdef MAILAKONADI_ENABLED
         {
             "file_export_certificate_to_provider", i18n("Publish at Mail Provider..."), i18n("Publish the selected certificate (public key) at mail provider's Web Key Directory if offered"),
             "view-certificate-export", nullptr, nullptr, QString()
         },
 #endif // MAILAKONADI_ENABLED
         {
             "file_export_secret_keys", i18n("Backup Secret Keys..."), QString(),
             "view-certificate-export-secret", nullptr, nullptr, QString()
         },
         {
             "file_export_paper_key", i18n("Print Secret Key..."), QString(),
             "document-print", nullptr, nullptr, QString()
         },
         {
             "file_lookup_certificates", i18n("Lookup on Server..."), i18n("Search for certificates online using a public keyserver"),
             "edit-find", nullptr, nullptr, QStringLiteral("Shift+Ctrl+I")
         },
         {
             "file_import_certificates", i18n("Import..."), i18n("Import a certificate from a file"),
             "view-certificate-import", nullptr, nullptr, QStringLiteral("Ctrl+I")
         },
         {
             "file_decrypt_verify_files", i18n("Decrypt/Verify..."), i18n("Decrypt and/or verify files"),
             "document-edit-decrypt-verify", nullptr, nullptr, QString()
         },
         {
             "file_sign_encrypt_files", i18n("Sign/Encrypt..."), i18n("Encrypt and/or sign files"),
             "document-edit-sign-encrypt", nullptr, nullptr, QString()
         },
         {
             "file_sign_encrypt_folder", i18n("Sign/Encrypt Folder..."), i18n("Encrypt and/or sign folders"),
             nullptr/*"folder-edit-sign-encrypt"*/, nullptr, nullptr, QString()
         },
         {
             "file_checksum_create_files", i18n("Create Checksum Files..."), QString(),
             nullptr/*"document-checksum-create"*/, nullptr, nullptr, QString()
         },
         {
             "file_checksum_verify_files", i18n("Verify Checksum Files..."), QString(),
             nullptr/*"document-checksum-verify"*/, nullptr, nullptr, QString()
         },
         // View menu
         {
             "view_redisplay", i18n("Redisplay"), QString(),
             "view-refresh", nullptr, nullptr, QStringLiteral("F5")
         },
         {
             "view_stop_operations", i18n("Stop Operation"), QString(),
             "process-stop", this, [this](bool) { cancelCommands(); }, QStringLiteral("Escape"), RegularQAction, Disabled
         },
         {
             "view_certificate_details", i18n("Details"), QString(),
             "dialog-information", nullptr, nullptr, QString()
         },
         // Certificate menu
 #ifdef QGPGME_SUPPORTS_KEY_REVOCATION
         {
             "certificates_revoke", i18n("Revoke Certificate..."), i18n("Revoke the selected OpenPGP certificate"),
             "view-certificate-revoke", nullptr, nullptr, {}
         },
 #endif
         {
             "certificates_delete", i18n("Delete"), i18n("Delete selected certificates"),
             "edit-delete", nullptr, nullptr, QStringLiteral("Delete")
         },
         {
             "certificates_certify_certificate", i18n("Certify..."), i18n("Certify the validity of the selected certificate"),
             "view-certificate-sign", nullptr, nullptr, QString()
         },
         {
             "certificates_revoke_certification", i18n("Revoke Certification..."), i18n("Revoke the certification of the selected certificate"),
             "view-certificate-revoke", nullptr, nullptr, QString()
         },
         {
             "certificates_change_expiry", i18n("Change Expiry Date..."), QString(),
             nullptr, nullptr, nullptr, QString()
         },
         {
             "certificates_change_owner_trust", i18n("Change Certification Trust..."), QString(),
             nullptr, nullptr, nullptr, QString()
         },
         {
             "certificates_change_passphrase", i18n("Change Passphrase..."), QString(),
             nullptr, nullptr, nullptr, QString()
         },
         {
             "certificates_add_userid", i18n("Add User ID..."), QString(),
             nullptr, nullptr, nullptr, QString()
         },
         // Tools menu
         {
             "tools_refresh_openpgp_certificates", i18n("Refresh OpenPGP Certificates"), QString(),
             "view-refresh", nullptr, nullptr, QString()
         },
         // Window menu
         // (come from TabWidget)
         // Help menu
         // (come from MainWindow)
     };
 
+    static const action_data cms_create_csr_action_data = {
+        "file_new_certificate_signing_request", i18n("New S/MIME Certification Request..."), i18n("Create a new S/MIME certificate signing request (CSR)"),
+        "view-certificate-add", nullptr, nullptr, {},
+    };
+
     static const std::vector<action_data> cms_action_data = {
         // Certificate menu
         {
             "certificates_trust_root", i18n("Trust Root Certificate"), QString(),
             nullptr, nullptr, nullptr, QString()
         },
         {
             "certificates_distrust_root", i18n("Distrust Root Certificate"), QString(),
             nullptr, nullptr, nullptr, QString()
         },
         {
             "certificates_dump_certificate", i18n("Technical Details"), QString(),
             nullptr, nullptr, nullptr, QString()
         },
         // Tools menu
         {
             "tools_refresh_x509_certificates", i18n("Refresh S/MIME Certificates"), QString(),
             "view-refresh", nullptr, nullptr, QString()
         },
         {
             "crl_clear_crl_cache", i18n("Clear CRL Cache"), QString(),
             nullptr, nullptr, nullptr, QString()
         },
         {
             "crl_dump_crl_cache", i18n("Dump CRL Cache"), QString(),
             nullptr, nullptr, nullptr, QString()
         },
         {
             "crl_import_crl", i18n("Import CRL From File..."), QString(),
             nullptr, nullptr, nullptr, QString()
         },
     };
 
     std::vector<action_data> action_data = common_and_openpgp_action_data;
 
-    if (Settings{}.cmsEnabled()) {
+    if (const Kleo::Settings settings{}; settings.cmsEnabled()) {
+        if (settings.cmsCertificateCreationAllowed()) {
+            action_data.push_back(cms_create_csr_action_data);
+        }
         action_data.reserve(action_data.size() + cms_action_data.size());
         std::copy(std::begin(cms_action_data), std::end(cms_action_data),
                   std::back_inserter(action_data));
     }
 
     make_actions_from_data(action_data, coll);
 
     if (QAction *action = coll->action(QStringLiteral("view_stop_operations"))) {
         connect(this, &KeyListController::commandsExecuting, action, &QAction::setEnabled);
     }
 
     // ### somehow make this better...
-    registerActionForCommand<NewCertificateCommand>(coll->action(QStringLiteral("file_new_certificate")));
+    registerActionForCommand<NewOpenPGPCertificateCommand>(coll->action(QStringLiteral("file_new_certificate")));
+    registerActionForCommand<NewCertificateCommand>(coll->action(QStringLiteral("file_new_certificate_signing_request")));
     //---
     registerActionForCommand<LookupCertificatesCommand>(coll->action(QStringLiteral("file_lookup_certificates")));
     registerActionForCommand<ImportCertificateFromFileCommand>(coll->action(QStringLiteral("file_import_certificates")));
     //---
     registerActionForCommand<ExportCertificateCommand>(coll->action(QStringLiteral("file_export_certificates")));
     registerActionForCommand<ExportSecretKeyCommand>(coll->action(QStringLiteral("file_export_secret_keys")));
     registerActionForCommand<ExportPaperKeyCommand>(coll->action(QStringLiteral("file_export_paper_key")));
     registerActionForCommand<ExportOpenPGPCertsToServerCommand>(coll->action(QStringLiteral("file_export_certificates_to_server")));
 #ifdef MAILAKONADI_ENABLED
     registerActionForCommand<ExportOpenPGPCertToProviderCommand>(coll->action(QStringLiteral("file_export_certificate_to_provider")));
 #endif // MAILAKONADI_ENABLED
     //---
     registerActionForCommand<DecryptVerifyFilesCommand>(coll->action(QStringLiteral("file_decrypt_verify_files")));
     registerActionForCommand<SignEncryptFilesCommand>(coll->action(QStringLiteral("file_sign_encrypt_files")));
     registerActionForCommand<SignEncryptFolderCommand>(coll->action(QStringLiteral("file_sign_encrypt_folder")));
     //---
     registerActionForCommand<ChecksumCreateFilesCommand>(coll->action(QStringLiteral("file_checksum_create_files")));
     registerActionForCommand<ChecksumVerifyFilesCommand>(coll->action(QStringLiteral("file_checksum_verify_files")));
 
     registerActionForCommand<ReloadKeysCommand>(coll->action(QStringLiteral("view_redisplay")));
     //coll->action( "view_stop_operations" ) <-- already dealt with in make_actions_from_data()
     registerActionForCommand<DetailsCommand>(coll->action(QStringLiteral("view_certificate_details")));
 
     registerActionForCommand<ChangeOwnerTrustCommand>(coll->action(QStringLiteral("certificates_change_owner_trust")));
     registerActionForCommand<TrustRootCommand>(coll->action(QStringLiteral("certificates_trust_root")));
     registerActionForCommand<DistrustRootCommand>(coll->action(QStringLiteral("certificates_distrust_root")));
     //---
     registerActionForCommand<CertifyCertificateCommand>(coll->action(QStringLiteral("certificates_certify_certificate")));
     if (RevokeCertificationCommand::isSupported()) {
         registerActionForCommand<RevokeCertificationCommand>(coll->action(QStringLiteral("certificates_revoke_certification")));
     }
     //---
     registerActionForCommand<ChangeExpiryCommand>(coll->action(QStringLiteral("certificates_change_expiry")));
     registerActionForCommand<ChangePassphraseCommand>(coll->action(QStringLiteral("certificates_change_passphrase")));
     registerActionForCommand<AddUserIDCommand>(coll->action(QStringLiteral("certificates_add_userid")));
     //---
 #ifdef QGPGME_SUPPORTS_KEY_REVOCATION
     registerActionForCommand<RevokeKeyCommand>(coll->action(QStringLiteral("certificates_revoke")));
 #endif
     registerActionForCommand<DeleteCertificatesCommand>(coll->action(QStringLiteral("certificates_delete")));
     //---
     registerActionForCommand<DumpCertificateCommand>(coll->action(QStringLiteral("certificates_dump_certificate")));
 
     registerActionForCommand<RefreshX509CertsCommand>(coll->action(QStringLiteral("tools_refresh_x509_certificates")));
     registerActionForCommand<RefreshOpenPGPCertsCommand>(coll->action(QStringLiteral("tools_refresh_openpgp_certificates")));
     //---
     registerActionForCommand<ImportCrlCommand>(coll->action(QStringLiteral("crl_import_crl")));
     //---
     registerActionForCommand<ClearCrlCacheCommand>(coll->action(QStringLiteral("crl_clear_crl_cache")));
     registerActionForCommand<DumpCrlCacheCommand>(coll->action(QStringLiteral("crl_dump_crl_cache")));
 
     enableDisableActions(nullptr);
 }
 
 void KeyListController::registerAction(QAction *action, Command::Restrictions restrictions, Command * (*create)(QAbstractItemView *, KeyListController *))
 {
     if (!action) {
         return;
     }
     Q_ASSERT(!action->isCheckable());   // can be added later, for now, disallow
 
     const Private::action_item ai = {
         action, restrictions, create
     };
     connect(action, &QAction::triggered, this, [this, action]() { d->slotActionTriggered(action); });
     d->actions.push_back(ai);
 }
 
 void KeyListController::registerCommand(Command *cmd)
 {
     if (!cmd || std::binary_search(d->commands.cbegin(), d->commands.cend(), cmd)) {
         return;
     }
     d->addCommand(cmd);
     qCDebug(KLEOPATRA_LOG) << (void *)cmd;
     if (d->commands.size() == 1) {
         Q_EMIT commandsExecuting(true);
     }
 }
 
 bool KeyListController::hasRunningCommands() const
 {
     return !d->commands.empty();
 }
 
 bool KeyListController::shutdownWarningRequired() const
 {
     return std::any_of(d->commands.cbegin(), d->commands.cend(), std::mem_fn(&Command::warnWhenRunningAtShutdown));
 }
 
 // slot
 void KeyListController::cancelCommands()
 {
     std::for_each(d->commands.begin(), d->commands.end(), std::mem_fn(&Command::cancel));
 }
 
 void KeyListController::Private::connectView(QAbstractItemView *view)
 {
 
     connect(view, &QObject::destroyed, q, [this](QObject *obj) { slotDestroyed(obj); });
     connect(view, &QAbstractItemView::doubleClicked, q, [this](const QModelIndex &index) { slotDoubleClicked(index); });
     connect(view, &QAbstractItemView::activated, q, [this](const QModelIndex &index) { slotActivated(index); });
     connect(view->selectionModel(), &QItemSelectionModel::selectionChanged,
             q, [this](const QItemSelection &oldSel, const QItemSelection &newSel) {
         slotSelectionChanged(oldSel, newSel);
     });
 
     view->setContextMenuPolicy(Qt::CustomContextMenu);
     connect(view, &QWidget::customContextMenuRequested, q, [this](const QPoint &pos) { slotContextMenu(pos); });
 }
 
 void KeyListController::Private::connectCommand(Command *cmd)
 {
     if (!cmd) {
         return;
     }
     connect(cmd, &QObject::destroyed, q, [this](QObject *obj) { slotDestroyed(obj); });
     connect(cmd, &Command::finished, q, [this] { slotCommandFinished(); });
     //connect( cmd, SIGNAL(canceled()), q, SLOT(slotCommandCanceled()) );
     connect(cmd, &Command::info, q, &KeyListController::message);
     connect(cmd, &Command::progress, q, [this](const QString &message, int current, int total) { slotProgress(message, current, total); });
 }
 
 void KeyListController::Private::slotDoubleClicked(const QModelIndex &idx)
 {
     QAbstractItemView *const view = qobject_cast<QAbstractItemView *>(q->sender());
     if (!view || !std::binary_search(views.cbegin(), views.cend(), view)) {
         return;
     }
 
     DetailsCommand *const c = new DetailsCommand(view, q);
     if (parentWidget) {
         c->setParentWidget(parentWidget);
     }
 
     c->setIndex(idx);
     c->start();
 }
 
 void KeyListController::Private::slotActivated(const QModelIndex &idx)
 {
     Q_UNUSED(idx)
     QAbstractItemView *const view = qobject_cast<QAbstractItemView *>(q->sender());
     if (!view || !std::binary_search(views.cbegin(), views.cend(), view)) {
         return;
     }
 
 }
 
 void KeyListController::Private::slotSelectionChanged(const QItemSelection &old, const QItemSelection &new_)
 {
     Q_UNUSED(old)
     Q_UNUSED(new_)
 
     const QItemSelectionModel *const sm = qobject_cast<QItemSelectionModel *>(q->sender());
     if (!sm) {
         return;
     }
     q->enableDisableActions(sm);
 }
 
 void KeyListController::Private::slotContextMenu(const QPoint &p)
 {
     QAbstractItemView *const view = qobject_cast<QAbstractItemView *>(q->sender());
     if (view && std::binary_search(views.cbegin(), views.cend(), view)) {
         Q_EMIT q->contextMenuRequested(view, view->viewport()->mapToGlobal(p));
     } else {
         qCDebug(KLEOPATRA_LOG) << "sender is not a QAbstractItemView*!";
     }
 }
 
 void KeyListController::Private::slotCommandFinished()
 {
     Command *const cmd = qobject_cast<Command *>(q->sender());
     if (!cmd || !std::binary_search(commands.cbegin(), commands.cend(), cmd)) {
         return;
     }
     qCDebug(KLEOPATRA_LOG) << (void *)cmd;
     if (commands.size() == 1) {
         Q_EMIT q->commandsExecuting(false);
     }
 }
 
 void KeyListController::enableDisableActions(const QItemSelectionModel *sm) const
 {
     const Command::Restrictions restrictionsMask = d->calculateRestrictionsMask(sm);
     for (const Private::action_item &ai : std::as_const(d->actions))
         if (ai.action) {
             ai.action->setEnabled(ai.restrictions == (ai.restrictions & restrictionsMask));
         }
 }
 
 static bool all_secret_are_not_owner_trust_ultimate(const std::vector<Key> &keys)
 {
     for (const Key &key : keys)
         if (key.hasSecret() && key.ownerTrust() == Key::Ultimate) {
             return false;
         }
     return true;
 }
 
 Command::Restrictions find_root_restrictions(const std::vector<Key> &keys)
 {
     bool trusted = false, untrusted = false;
     for (const Key &key : keys)
         if (key.isRoot())
             if (key.userID(0).validity() == UserID::Ultimate) {
                 trusted = true;
             } else {
                 untrusted = true;
             }
         else {
             return Command::NoRestriction;
         }
     if (trusted)
         if (untrusted) {
             return Command::NoRestriction;
         } else {
             return Command::MustBeTrustedRoot;
         }
     else if (untrusted) {
         return Command::MustBeUntrustedRoot;
     } else {
         return Command::NoRestriction;
     }
 }
 
 Command::Restrictions KeyListController::Private::calculateRestrictionsMask(const QItemSelectionModel *sm)
 {
     if (!sm) {
         return Command::NoRestriction;
     }
 
     const KeyListModelInterface *const m = dynamic_cast<const KeyListModelInterface *>(sm->model());
     if (!m) {
         return Command::NoRestriction;
     }
 
     const std::vector<Key> keys = m->keys(sm->selectedRows());
     if (keys.empty()) {
         return Command::NoRestriction;
     }
 
     Command::Restrictions result = Command::NeedSelection;
 
     if (keys.size() == 1) {
         result |= Command::OnlyOneKey;
     }
 
 #if GPGME_VERSION_NUMBER >= 0x011102 // 1.17.2
     // we need to check the primary subkey because Key::hasSecret() is also true if just the secret key stub of an offline key is available
     const auto primaryKeyCanBeUsedForSecretKeyOperations = [](const auto &k) { return k.subkey(0).isSecret(); };
 #else
     // older versions of GpgME did not always set the secret flag for card keys
     const auto primaryKeyCanBeUsedForSecretKeyOperations = [](const auto &k) { return k.subkey(0).isSecret() || k.subkey(0).isCardKey(); };
 #endif
     if (std::all_of(keys.cbegin(), keys.cend(), primaryKeyCanBeUsedForSecretKeyOperations)) {
         result |= Command::NeedSecretKey;
     }
 
     if (std::all_of(std::begin(keys), std::end(keys), [](const auto &k) { return k.subkey(0).isSecret() && !k.subkey(0).isCardKey(); })) {
         result |= Command::NeedSecretKeyData;
     }
 
     if (std::all_of(keys.cbegin(), keys.cend(), [](const Key &key) { return key.protocol() == OpenPGP; })) {
         result |= Command::MustBeOpenPGP;
     } else if (std::all_of(keys.cbegin(), keys.cend(), [](const Key &key) { return key.protocol() == CMS; })) {
         result |= Command::MustBeCMS;
     }
 
     if (all_secret_are_not_owner_trust_ultimate(keys)) {
         result |= Command::MayOnlyBeSecretKeyIfOwnerTrustIsNotYetUltimate;
     }
 
     result |= find_root_restrictions(keys);
 
     if (const ReaderStatus *rs = ReaderStatus::instance()) {
         if (!rs->firstCardWithNullPin().empty()) {
             result |= Command::AnyCardHasNullPin;
         }
         if (rs->anyCardCanLearnKeys()) {
             result |= Command::AnyCardCanLearnKeys;
         }
     }
 
     return result;
 }
 
 void KeyListController::Private::slotActionTriggered(QAction *sender)
 {
     const auto it = std::find_if(actions.cbegin(), actions.cend(),
                                  [sender](const action_item &item) { return item.action == sender; });
     if (it != actions.end())
         if (Command *const c = it->createCommand(this->currentView, q)) {
             if (parentWidget) {
                 c->setParentWidget(parentWidget);
             }
             c->start();
         } else
             qCDebug(KLEOPATRA_LOG) << "createCommand() == NULL for action(?) \""
                                     << qPrintable(sender->objectName()) << "\"";
     else {
         qCDebug(KLEOPATRA_LOG) << "I don't know anything about action(?) \"%s\"", qPrintable(sender->objectName());
     }
 }
 
 int KeyListController::Private::toolTipOptions() const
 {
     using namespace Kleo::Formatting;
     static const int validityFlags = Validity | Issuer | ExpiryDates | CertificateUsage;
     static const int ownerFlags = Subject | UserIDs | OwnerTrust;
     static const int detailsFlags = StorageLocation | CertificateType | SerialNumber | Fingerprint;
 
     const TooltipPreferences prefs;
 
     int flags = KeyID;
     flags |= prefs.showValidity() ? validityFlags : 0;
     flags |= prefs.showOwnerInformation() ? ownerFlags : 0;
     flags |= prefs.showCertificateDetails() ? detailsFlags : 0;
     return flags;
 }
 
 void KeyListController::updateConfig()
 {
     const int opts = d->toolTipOptions();
     if (d->flatModel) {
         d->flatModel->setToolTipOptions(opts);
     }
     if (d->hierarchicalModel) {
         d->hierarchicalModel->setToolTipOptions(opts);
     }
 }
 
 #include "moc_keylistcontroller.cpp"