diff --git a/src/models/keylistmodel.cpp b/src/models/keylistmodel.cpp
index dcb95f0b2..197133ebf 100644
--- a/src/models/keylistmodel.cpp
+++ b/src/models/keylistmodel.cpp
@@ -1,1667 +1,1675 @@
 /* -*- mode: c++; c-basic-offset:4 -*-
     models/keylistmodel.cpp
 
     This file is part of libkleopatra, the KDE keymanagement library
     SPDX-FileCopyrightText: 2007 Klarälvdalens Datakonsult AB
     SPDX-FileCopyrightText: 2021 g10 Code GmbH
     SPDX-FileContributor: Ingo Klöcker <dev@ingo-kloecker.de>
 
     SPDX-License-Identifier: GPL-2.0-or-later
 */
 
 #include <config-libkleo.h>
 
 #include "keylistmodel.h"
 
 #include "keycache.h"
 
 #include <libkleo/algorithm.h>
 #include <libkleo/formatting.h>
 #include <libkleo/keyfilter.h>
 #include <libkleo/keyfiltermanager.h>
 #include <libkleo/predicates.h>
 #include <libkleo/systeminfo.h>
 
 #include <KLocalizedString>
 
 #ifdef KLEO_MODEL_TEST
 #include <QAbstractItemModelTester>
 #endif
 #include <QColor>
 #include <QDate>
 #include <QFont>
 #include <QHash>
 #include <QIcon>
 #include <QMimeData>
 
 #include <gpgme++/key.h>
 
 #ifndef Q_MOC_RUN // QTBUG-22829
 #include <boost/graph/adjacency_list.hpp>
 #include <boost/graph/topological_sort.hpp>
 #endif
 
 #include <algorithm>
 #include <iterator>
 #include <map>
 #include <set>
 
 using namespace GpgME;
 using namespace Kleo;
 using namespace Kleo::KeyList;
 
 #if !UNITY_BUILD
 Q_DECLARE_METATYPE(GpgME::Key)
 Q_DECLARE_METATYPE(KeyGroup)
 #endif
 
 class AbstractKeyListModel::Private
 {
     AbstractKeyListModel *const q;
 
 public:
     explicit Private(AbstractKeyListModel *qq);
 
     void updateFromKeyCache();
 
     QString getEMail(const Key &key) const;
 
 public:
     int m_toolTipOptions = Formatting::Validity;
     mutable QHash<const char *, QString> prettyEMailCache;
     mutable QHash<const char *, QVariant> remarksCache;
     bool m_useKeyCache = false;
     bool m_modelResetInProgress = false;
     KeyList::Options m_keyListOptions = AllKeys;
     std::vector<GpgME::Key> m_remarkKeys;
     std::shared_ptr<DragHandler> m_dragHandler;
 };
 
 AbstractKeyListModel::Private::Private(Kleo::AbstractKeyListModel *qq)
     : q(qq)
 {
 }
 
 void AbstractKeyListModel::Private::updateFromKeyCache()
 {
     if (m_useKeyCache) {
         const bool inReset = q->modelResetInProgress();
         if (!inReset) {
             q->beginResetModel();
         }
         q->setKeys(m_keyListOptions == SecretKeysOnly ? KeyCache::instance()->secretKeys() : KeyCache::instance()->keys());
         if (m_keyListOptions == IncludeGroups) {
             q->setGroups(KeyCache::instance()->groups());
         }
         if (!inReset) {
             q->endResetModel();
         }
     }
 }
 
 QString AbstractKeyListModel::Private::getEMail(const Key &key) const
 {
     QString email;
     if (const auto fpr = key.primaryFingerprint()) {
         const auto it = prettyEMailCache.constFind(fpr);
         if (it != prettyEMailCache.constEnd()) {
             email = *it;
         } else {
             email = Formatting::prettyEMail(key);
             prettyEMailCache[fpr] = email;
         }
     }
     return email;
 }
 
 AbstractKeyListModel::AbstractKeyListModel(QObject *p)
     : QAbstractItemModel(p)
     , KeyListModelInterface()
     , d(new Private(this))
 {
     connect(this, &QAbstractItemModel::modelAboutToBeReset, this, [this]() {
         d->m_modelResetInProgress = true;
     });
     connect(this, &QAbstractItemModel::modelReset, this, [this]() {
         d->m_modelResetInProgress = false;
     });
 }
 
 AbstractKeyListModel::~AbstractKeyListModel()
 {
 }
 
 void AbstractKeyListModel::setToolTipOptions(int opts)
 {
     d->m_toolTipOptions = opts;
 }
 
 int AbstractKeyListModel::toolTipOptions() const
 {
     return d->m_toolTipOptions;
 }
 
 void AbstractKeyListModel::setRemarkKeys(const std::vector<GpgME::Key> &keys)
 {
     d->m_remarkKeys = keys;
 }
 
 std::vector<GpgME::Key> AbstractKeyListModel::remarkKeys() const
 {
     return d->m_remarkKeys;
 }
 
 Key AbstractKeyListModel::key(const QModelIndex &idx) const
 {
     Key key = Key::null;
     if (idx.isValid()) {
         key = doMapToKey(idx);
     }
     return key;
 }
 
 std::vector<Key> AbstractKeyListModel::keys(const QList<QModelIndex> &indexes) const
 {
     std::vector<Key> result;
     result.reserve(indexes.size());
     std::transform(indexes.begin(), //
                    indexes.end(),
                    std::back_inserter(result),
                    [this](const QModelIndex &idx) {
                        return this->key(idx);
                    });
     result.erase(std::remove_if(result.begin(), result.end(), std::mem_fn(&GpgME::Key::isNull)), result.end());
     _detail::remove_duplicates_by_fpr(result);
     return result;
 }
 
 KeyGroup AbstractKeyListModel::group(const QModelIndex &idx) const
 {
     if (idx.isValid()) {
         return doMapToGroup(idx);
     } else {
         return KeyGroup();
     }
 }
 
 QModelIndex AbstractKeyListModel::index(const Key &key) const
 {
     return index(key, 0);
 }
 
 QModelIndex AbstractKeyListModel::index(const Key &key, int col) const
 {
     if (key.isNull() || col < 0 || col >= NumColumns) {
         return {};
     } else {
         return doMapFromKey(key, col);
     }
 }
 
 QList<QModelIndex> AbstractKeyListModel::indexes(const std::vector<Key> &keys) const
 {
     QList<QModelIndex> result;
     result.reserve(keys.size());
     std::transform(keys.begin(), //
                    keys.end(),
                    std::back_inserter(result),
                    [this](const Key &key) {
                        return this->index(key);
                    });
     return result;
 }
 
 QModelIndex AbstractKeyListModel::index(const KeyGroup &group) const
 {
     return index(group, 0);
 }
 
 QModelIndex AbstractKeyListModel::index(const KeyGroup &group, int col) const
 {
     if (group.isNull() || col < 0 || col >= NumColumns) {
         return {};
     } else {
         return doMapFromGroup(group, col);
     }
 }
 
 void AbstractKeyListModel::setKeys(const std::vector<Key> &keys)
 {
     const bool inReset = modelResetInProgress();
     if (!inReset) {
         beginResetModel();
     }
     clear(Keys);
     addKeys(keys);
     if (!inReset) {
         endResetModel();
     }
 }
 
 QModelIndex AbstractKeyListModel::addKey(const Key &key)
 {
     const std::vector<Key> vec(1, key);
     const QList<QModelIndex> l = doAddKeys(vec);
     return l.empty() ? QModelIndex() : l.front();
 }
 
 void AbstractKeyListModel::removeKey(const Key &key)
 {
     if (key.isNull()) {
         return;
     }
     doRemoveKey(key);
     d->prettyEMailCache.remove(key.primaryFingerprint());
     d->remarksCache.remove(key.primaryFingerprint());
 }
 
 QList<QModelIndex> AbstractKeyListModel::addKeys(const std::vector<Key> &keys)
 {
     std::vector<Key> sorted;
     sorted.reserve(keys.size());
     std::remove_copy_if(keys.begin(), keys.end(), std::back_inserter(sorted), std::mem_fn(&Key::isNull));
     std::sort(sorted.begin(), sorted.end(), _detail::ByFingerprint<std::less>());
     return doAddKeys(sorted);
 }
 
 void AbstractKeyListModel::setGroups(const std::vector<KeyGroup> &groups)
 {
     const bool inReset = modelResetInProgress();
     if (!inReset) {
         beginResetModel();
     }
     clear(Groups);
     doSetGroups(groups);
     if (!inReset) {
         endResetModel();
     }
 }
 
 QModelIndex AbstractKeyListModel::addGroup(const KeyGroup &group)
 {
     if (group.isNull()) {
         return QModelIndex();
     }
     return doAddGroup(group);
 }
 
 bool AbstractKeyListModel::removeGroup(const KeyGroup &group)
 {
     if (group.isNull()) {
         return false;
     }
     return doRemoveGroup(group);
 }
 
 void AbstractKeyListModel::clear(ItemTypes types)
 {
     const bool inReset = modelResetInProgress();
     if (!inReset) {
         beginResetModel();
     }
     doClear(types);
     if (types & Keys) {
         d->prettyEMailCache.clear();
         d->remarksCache.clear();
     }
     if (!inReset) {
         endResetModel();
     }
 }
 
 int AbstractKeyListModel::columnCount(const QModelIndex &) const
 {
     return NumColumns;
 }
 
 QVariant AbstractKeyListModel::headerData(int section, Qt::Orientation o, int role) const
 {
     if (o == Qt::Horizontal) {
         if (role == Qt::DisplayRole || role == Qt::EditRole || role == Qt::ToolTipRole) {
             switch (section) {
             case PrettyName:
                 return i18nc("@title:column", "Name");
             case PrettyEMail:
                 return i18nc("@title:column", "E-Mail");
             case Validity:
                 return i18nc("@title:column", "User-IDs");
             case ValidFrom:
                 return i18nc("@title:column", "Valid From");
             case ValidUntil:
                 return i18nc("@title:column", "Valid Until");
             case TechnicalDetails:
                 return i18nc("@title:column", "Protocol");
             case ShortKeyID:
                 return i18nc("@title:column", "Key-ID");
             case KeyID:
                 return i18nc("@title:column", "Key-ID");
             case Fingerprint:
                 return i18nc("@title:column", "Fingerprint");
             case Issuer:
                 return i18nc("@title:column", "Issuer");
             case SerialNumber:
                 return i18nc("@title:column", "Serial Number");
             case Origin:
                 return i18nc("@title:column", "Origin");
             case LastUpdate:
                 return i18nc("@title:column", "Last Update");
             case OwnerTrust:
                 return i18nc("@title:column", "Certification Trust");
             case Remarks:
                 return i18nc("@title:column", "Tags");
             case Algorithm:
                 return i18nc("@title:column", "Algorithm");
             case Keygrip:
                 return i18nc("@title:column", "Keygrip");
             case NumColumns:;
             }
         }
     }
     return QVariant();
 }
 
 static QVariant returnIfValid(const QColor &t)
 {
     if (t.isValid()) {
         return t;
     } else {
         return QVariant();
     }
 }
 
 static QVariant returnIfValid(const QIcon &t)
 {
     if (!t.isNull()) {
         return t;
     } else {
         return QVariant();
     }
 }
 
 QVariant AbstractKeyListModel::data(const QModelIndex &index, int role) const
 {
     const Key key = this->key(index);
     if (!key.isNull()) {
         return data(key, index.column(), role);
     }
 
     const KeyGroup group = this->group(index);
     if (!group.isNull()) {
         return data(group, index.column(), role);
     }
 
     return QVariant();
 }
 
 QVariant AbstractKeyListModel::data(const Key &key, int column, int role) const
 {
     if (role == Qt::DisplayRole || role == Qt::EditRole || role == Qt::AccessibleTextRole) {
         switch (column) {
         case PrettyName: {
             const auto name = Formatting::prettyName(key);
             if (role == Qt::AccessibleTextRole) {
                 return name.isEmpty() ? i18nc("text for screen readers for an empty name", "no name") : name;
             }
             return name;
         }
         case PrettyEMail: {
             const auto email = d->getEMail(key);
             if (role == Qt::AccessibleTextRole) {
                 return email.isEmpty() ? i18nc("text for screen readers for an empty email address", "no email") : email;
             }
             return email;
         }
         case Validity:
             return Formatting::complianceStringShort(key);
         case ValidFrom:
             if (role == Qt::EditRole) {
                 return Formatting::creationDate(key);
             } else if (role == Qt::AccessibleTextRole) {
                 return Formatting::accessibleCreationDate(key);
             } else {
                 return Formatting::creationDateString(key);
             }
         case ValidUntil:
             if (role == Qt::EditRole) {
                 return Formatting::expirationDate(key);
             } else if (role == Qt::AccessibleTextRole) {
                 return Formatting::accessibleExpirationDate(key);
             } else {
                 return Formatting::expirationDateString(key);
             }
         case TechnicalDetails:
             return Formatting::type(key);
         case ShortKeyID:
             if (role == Qt::AccessibleTextRole) {
                 return Formatting::accessibleHexID(key.shortKeyID());
             } else {
                 return Formatting::prettyID(key.shortKeyID());
             }
         case KeyID:
             if (role == Qt::AccessibleTextRole) {
                 return Formatting::accessibleHexID(key.keyID());
             } else {
                 return Formatting::prettyID(key.keyID());
             }
         case Summary:
             return Formatting::summaryLine(key);
         case Fingerprint:
             if (role == Qt::AccessibleTextRole) {
                 return Formatting::accessibleHexID(key.primaryFingerprint());
             } else {
                 return Formatting::prettyID(key.primaryFingerprint());
             }
         case Issuer:
             return QString::fromUtf8(key.issuerName());
         case Origin:
             return Formatting::origin(key.origin());
         case LastUpdate:
             if (role == Qt::AccessibleTextRole) {
                 return Formatting::accessibleDate(key.lastUpdate());
             } else {
                 return Formatting::dateString(key.lastUpdate());
             }
         case SerialNumber:
             return QString::fromUtf8(key.issuerSerial());
         case OwnerTrust:
             return Formatting::ownerTrustShort(key.ownerTrust());
         case Remarks: {
             const char *const fpr = key.primaryFingerprint();
             if (fpr && key.protocol() == GpgME::OpenPGP && key.numUserIDs() && d->m_remarkKeys.size()) {
                 if (!(key.keyListMode() & GpgME::SignatureNotations)) {
                     return i18n("Loading...");
                 }
                 const QHash<const char *, QVariant>::const_iterator it = d->remarksCache.constFind(fpr);
                 if (it != d->remarksCache.constEnd()) {
                     return *it;
                 } else {
                     GpgME::Error err;
                     const auto remarks = key.userID(0).remarks(d->m_remarkKeys, err);
                     if (remarks.size() == 1) {
                         const auto remark = QString::fromStdString(remarks[0]);
                         return d->remarksCache[fpr] = remark;
                     } else {
                         QStringList remarkList;
                         remarkList.reserve(remarks.size());
                         for (const auto &rem : remarks) {
                             remarkList << QString::fromStdString(rem);
                         }
                         const auto remark = remarkList.join(QStringLiteral("; "));
                         return d->remarksCache[fpr] = remark;
                     }
                 }
             } else {
                 return QVariant();
             }
         }
             return QVariant();
         case Algorithm:
             return Formatting::prettyAlgorithmName(key.subkey(0).algoName());
         case Keygrip:
             if (role == Qt::AccessibleTextRole) {
                 return Formatting::accessibleHexID(key.subkey(0).keyGrip());
             } else {
                 return Formatting::prettyID(key.subkey(0).keyGrip());
             }
         case NumColumns:
             break;
         }
     } else if (role == Qt::ToolTipRole) {
         return Formatting::toolTip(key, toolTipOptions());
     } else if (role == Qt::FontRole) {
         return KeyFilterManager::instance()->font(key,
                                                   (column == ShortKeyID || column == KeyID || column == Fingerprint) ? QFont(QStringLiteral("monospace"))
                                                                                                                      : QFont());
     } else if (role == Qt::DecorationRole) {
         return column == Icon ? returnIfValid(KeyFilterManager::instance()->icon(key)) : QVariant();
     } else if (role == Qt::BackgroundRole) {
         if (!SystemInfo::isHighContrastModeActive()) {
             return returnIfValid(KeyFilterManager::instance()->bgColor(key));
         }
     } else if (role == Qt::ForegroundRole) {
         if (!SystemInfo::isHighContrastModeActive()) {
             return returnIfValid(KeyFilterManager::instance()->fgColor(key));
         }
     } else if (role == FingerprintRole) {
         return QString::fromLatin1(key.primaryFingerprint());
     } else if (role == KeyRole) {
         return QVariant::fromValue(key);
     }
     return QVariant();
 }
 
 QVariant AbstractKeyListModel::data(const KeyGroup &group, int column, int role) const
 {
     if (role == Qt::DisplayRole || role == Qt::EditRole || role == Qt::AccessibleTextRole) {
         switch (column) {
         case PrettyName:
             return group.name();
         case Validity:
             return Formatting::complianceStringShort(group);
         case TechnicalDetails:
             return Formatting::type(group);
         case Summary:
             return Formatting::summaryLine(group); // used for filtering
         case PrettyEMail:
         case ValidFrom:
         case ValidUntil:
         case ShortKeyID:
         case KeyID:
         case Fingerprint:
         case Issuer:
         case Origin:
         case LastUpdate:
         case SerialNumber:
         case OwnerTrust:
         case Remarks:
             if (role == Qt::AccessibleTextRole) {
                 return i18nc("text for screen readers", "not applicable");
             }
             break;
         case NumColumns:
             break;
         }
     } else if (role == Qt::ToolTipRole) {
         return Formatting::toolTip(group, toolTipOptions());
     } else if (role == Qt::FontRole) {
         return QFont();
     } else if (role == Qt::DecorationRole) {
-        return column == Icon ? QIcon::fromTheme(QStringLiteral("group")) : QVariant();
+        if (column != Icon && column != Summary) {
+            return QVariant();
+        }
+        return Kleo::all_of(group.keys(),
+                            [](const auto &key) {
+                                return key.hasEncrypt();
+                            })
+            ? QIcon::fromTheme(QStringLiteral("group"))
+            : QIcon::fromTheme(QStringLiteral("emblem-warning"));
     } else if (role == Qt::BackgroundRole) {
     } else if (role == Qt::ForegroundRole) {
     } else if (role == GroupRole) {
         return QVariant::fromValue(group);
     }
     return QVariant();
 }
 
 bool AbstractKeyListModel::setData(const QModelIndex &index, const QVariant &value, int role)
 {
     Q_UNUSED(role)
     Q_ASSERT(value.canConvert<KeyGroup>());
     if (value.canConvert<KeyGroup>()) {
         const KeyGroup group = value.value<KeyGroup>();
         return doSetGroupData(index, group);
     }
 
     return false;
 }
 
 bool AbstractKeyListModel::modelResetInProgress()
 {
     return d->m_modelResetInProgress;
 }
 
 namespace
 {
 template<typename Base>
 class TableModelMixin : public Base
 {
 public:
     explicit TableModelMixin(QObject *p = nullptr)
         : Base(p)
     {
     }
     ~TableModelMixin() override
     {
     }
 
     using Base::index;
     QModelIndex index(int row, int column, const QModelIndex &pidx = QModelIndex()) const override
     {
         return this->hasIndex(row, column, pidx) ? this->createIndex(row, column, nullptr) : QModelIndex();
     }
 
 private:
     QModelIndex parent(const QModelIndex &) const override
     {
         return QModelIndex();
     }
     bool hasChildren(const QModelIndex &pidx) const override
     {
         return (pidx.model() == this || !pidx.isValid()) && this->rowCount(pidx) > 0 && this->columnCount(pidx) > 0;
     }
 };
 
 class FlatKeyListModel
 #ifndef Q_MOC_RUN
     : public TableModelMixin<AbstractKeyListModel>
 #else
     : public AbstractKeyListModel
 #endif
 {
     Q_OBJECT
 public:
     explicit FlatKeyListModel(QObject *parent = nullptr);
     ~FlatKeyListModel() override;
 
     int rowCount(const QModelIndex &pidx) const override
     {
         return pidx.isValid() ? 0 : mKeysByFingerprint.size() + mGroups.size();
     }
 
 private:
     Key doMapToKey(const QModelIndex &index) const override;
     QModelIndex doMapFromKey(const Key &key, int col) const override;
     QList<QModelIndex> doAddKeys(const std::vector<Key> &keys) override;
     void doRemoveKey(const Key &key) override;
 
     KeyGroup doMapToGroup(const QModelIndex &index) const override;
     QModelIndex doMapFromGroup(const KeyGroup &group, int column) const override;
     void doSetGroups(const std::vector<KeyGroup> &groups) override;
     QModelIndex doAddGroup(const KeyGroup &group) override;
     bool doSetGroupData(const QModelIndex &index, const KeyGroup &group) override;
     bool doRemoveGroup(const KeyGroup &group) override;
 
     void doClear(ItemTypes types) override
     {
         if (types & Keys) {
             mKeysByFingerprint.clear();
         }
         if (types & Groups) {
             mGroups.clear();
         }
     }
 
     int firstGroupRow() const
     {
         return mKeysByFingerprint.size();
     }
 
     int lastGroupRow() const
     {
         return mKeysByFingerprint.size() + mGroups.size() - 1;
     }
 
     int groupIndex(const QModelIndex &index) const
     {
         if (!index.isValid() || index.row() < firstGroupRow() || index.row() > lastGroupRow() || index.column() >= NumColumns) {
             return -1;
         }
         return index.row() - firstGroupRow();
     }
 
 private:
     std::vector<Key> mKeysByFingerprint;
     std::vector<KeyGroup> mGroups;
 };
 
 class HierarchicalKeyListModel : public AbstractKeyListModel
 {
     Q_OBJECT
 public:
     explicit HierarchicalKeyListModel(QObject *parent = nullptr);
     ~HierarchicalKeyListModel() override;
 
     int rowCount(const QModelIndex &pidx) const override;
     using AbstractKeyListModel::index;
     QModelIndex index(int row, int col, const QModelIndex &pidx) const override;
     QModelIndex parent(const QModelIndex &idx) const override;
 
     bool hasChildren(const QModelIndex &pidx) const override
     {
         return rowCount(pidx) > 0;
     }
 
 private:
     Key doMapToKey(const QModelIndex &index) const override;
     QModelIndex doMapFromKey(const Key &key, int col) const override;
     QList<QModelIndex> doAddKeys(const std::vector<Key> &keys) override;
     void doRemoveKey(const Key &key) override;
 
     KeyGroup doMapToGroup(const QModelIndex &index) const override;
     QModelIndex doMapFromGroup(const KeyGroup &group, int column) const override;
     void doSetGroups(const std::vector<KeyGroup> &groups) override;
     QModelIndex doAddGroup(const KeyGroup &group) override;
     bool doSetGroupData(const QModelIndex &index, const KeyGroup &group) override;
     bool doRemoveGroup(const KeyGroup &group) override;
 
     void doClear(ItemTypes types) override;
 
     int firstGroupRow() const
     {
         return mTopLevels.size();
     }
 
     int lastGroupRow() const
     {
         return mTopLevels.size() + mGroups.size() - 1;
     }
 
     int groupIndex(const QModelIndex &index) const
     {
         if (!index.isValid() || index.row() < firstGroupRow() || index.row() > lastGroupRow() || index.column() >= NumColumns) {
             return -1;
         }
         return index.row() - firstGroupRow();
     }
 
 private:
     void addTopLevelKey(const Key &key);
     void addKeyWithParent(const char *issuer_fpr, const Key &key);
     void addKeyWithoutParent(const char *issuer_fpr, const Key &key);
 
 private:
     typedef std::map<std::string, std::vector<Key>> Map;
     std::vector<Key> mKeysByFingerprint; // all keys
     Map mKeysByExistingParent, mKeysByNonExistingParent; // parent->child map
     std::vector<Key> mTopLevels; // all roots + parent-less
     std::vector<KeyGroup> mGroups;
 };
 
 class Issuers
 {
     Issuers()
     {
     }
 
 public:
     static Issuers *instance()
     {
         static auto self = std::unique_ptr<Issuers>{new Issuers{}};
         return self.get();
     }
 
     const char *cleanChainID(const Key &key) const
     {
         const char *chainID = "";
         if (!key.isRoot()) {
             const char *const chid = key.chainID();
             if (chid && mKeysWithMaskedIssuer.find(key) == std::end(mKeysWithMaskedIssuer)) {
                 chainID = chid;
             }
         }
         return chainID;
     }
 
     void maskIssuerOfKey(const Key &key)
     {
         mKeysWithMaskedIssuer.insert(key);
     }
 
     void clear()
     {
         mKeysWithMaskedIssuer.clear();
     }
 
 private:
     std::set<Key, _detail::ByFingerprint<std::less>> mKeysWithMaskedIssuer;
 };
 
 static const char *cleanChainID(const Key &key)
 {
     return Issuers::instance()->cleanChainID(key);
 }
 
 }
 
 FlatKeyListModel::FlatKeyListModel(QObject *p)
     : TableModelMixin<AbstractKeyListModel>(p)
 {
 }
 
 FlatKeyListModel::~FlatKeyListModel()
 {
 }
 
 Key FlatKeyListModel::doMapToKey(const QModelIndex &idx) const
 {
     Q_ASSERT(idx.isValid());
     if (static_cast<unsigned>(idx.row()) < mKeysByFingerprint.size() && idx.column() < NumColumns) {
         return mKeysByFingerprint[idx.row()];
     } else {
         return Key::null;
     }
 }
 
 QModelIndex FlatKeyListModel::doMapFromKey(const Key &key, int col) const
 {
     Q_ASSERT(!key.isNull());
     const std::vector<Key>::const_iterator it =
         std::lower_bound(mKeysByFingerprint.begin(), mKeysByFingerprint.end(), key, _detail::ByFingerprint<std::less>());
     if (it == mKeysByFingerprint.end() || !_detail::ByFingerprint<std::equal_to>()(*it, key)) {
         return {};
     } else {
         return createIndex(it - mKeysByFingerprint.begin(), col);
     }
 }
 
 QList<QModelIndex> FlatKeyListModel::doAddKeys(const std::vector<Key> &keys)
 {
     Q_ASSERT(std::is_sorted(keys.begin(), keys.end(), _detail::ByFingerprint<std::less>()));
 
     if (keys.empty()) {
         return QList<QModelIndex>();
     }
 
     for (auto it = keys.begin(), end = keys.end(); it != end; ++it) {
         // find an insertion point:
         const std::vector<Key>::iterator pos = std::upper_bound(mKeysByFingerprint.begin(), mKeysByFingerprint.end(), *it, _detail::ByFingerprint<std::less>());
         const unsigned int idx = std::distance(mKeysByFingerprint.begin(), pos);
 
         if (idx > 0 && qstrcmp(mKeysByFingerprint[idx - 1].primaryFingerprint(), it->primaryFingerprint()) == 0) {
             // key existed before - replace with new one:
             mKeysByFingerprint[idx - 1] = *it;
             if (!modelResetInProgress()) {
                 Q_EMIT dataChanged(createIndex(idx - 1, 0), createIndex(idx - 1, NumColumns - 1));
             }
         } else {
             // new key - insert:
             if (!modelResetInProgress()) {
                 beginInsertRows(QModelIndex(), idx, idx);
             }
             mKeysByFingerprint.insert(pos, *it);
             if (!modelResetInProgress()) {
                 endInsertRows();
             }
         }
     }
 
     return indexes(keys);
 }
 
 void FlatKeyListModel::doRemoveKey(const Key &key)
 {
     const std::vector<Key>::iterator it = Kleo::binary_find(mKeysByFingerprint.begin(), mKeysByFingerprint.end(), key, _detail::ByFingerprint<std::less>());
     if (it == mKeysByFingerprint.end()) {
         return;
     }
 
     const unsigned int row = std::distance(mKeysByFingerprint.begin(), it);
     if (!modelResetInProgress()) {
         beginRemoveRows(QModelIndex(), row, row);
     }
     mKeysByFingerprint.erase(it);
     if (!modelResetInProgress()) {
         endRemoveRows();
     }
 }
 
 KeyGroup FlatKeyListModel::doMapToGroup(const QModelIndex &idx) const
 {
     Q_ASSERT(idx.isValid());
     if (static_cast<unsigned>(idx.row()) >= mKeysByFingerprint.size() && static_cast<unsigned>(idx.row()) < mKeysByFingerprint.size() + mGroups.size()
         && idx.column() < NumColumns) {
         return mGroups[idx.row() - mKeysByFingerprint.size()];
     } else {
         return KeyGroup();
     }
 }
 
 QModelIndex FlatKeyListModel::doMapFromGroup(const KeyGroup &group, int column) const
 {
     Q_ASSERT(!group.isNull());
     const auto it = std::find_if(mGroups.cbegin(), mGroups.cend(), [group](const KeyGroup &g) {
         return g.source() == group.source() && g.id() == group.id();
     });
     if (it == mGroups.cend()) {
         return QModelIndex();
     } else {
         return createIndex(it - mGroups.cbegin() + mKeysByFingerprint.size(), column);
     }
 }
 
 void FlatKeyListModel::doSetGroups(const std::vector<KeyGroup> &groups)
 {
     Q_ASSERT(mGroups.empty()); // ensure that groups have been cleared
     const int first = mKeysByFingerprint.size();
     const int last = first + groups.size() - 1;
     if (!modelResetInProgress()) {
         beginInsertRows(QModelIndex(), first, last);
     }
     mGroups = groups;
     if (!modelResetInProgress()) {
         endInsertRows();
     }
 }
 
 QModelIndex FlatKeyListModel::doAddGroup(const KeyGroup &group)
 {
     const int newRow = lastGroupRow() + 1;
     if (!modelResetInProgress()) {
         beginInsertRows(QModelIndex(), newRow, newRow);
     }
     mGroups.push_back(group);
     if (!modelResetInProgress()) {
         endInsertRows();
     }
     return createIndex(newRow, 0);
 }
 
 bool FlatKeyListModel::doSetGroupData(const QModelIndex &index, const KeyGroup &group)
 {
     if (group.isNull()) {
         return false;
     }
     const int groupIndex = this->groupIndex(index);
     if (groupIndex == -1) {
         return false;
     }
     mGroups[groupIndex] = group;
     if (!modelResetInProgress()) {
         Q_EMIT dataChanged(createIndex(index.row(), 0), createIndex(index.row(), NumColumns - 1));
     }
     return true;
 }
 
 bool FlatKeyListModel::doRemoveGroup(const KeyGroup &group)
 {
     const QModelIndex modelIndex = doMapFromGroup(group, 0);
     if (!modelIndex.isValid()) {
         return false;
     }
     const int groupIndex = this->groupIndex(modelIndex);
     Q_ASSERT(groupIndex != -1);
     if (groupIndex == -1) {
         return false;
     }
     if (!modelResetInProgress()) {
         beginRemoveRows(QModelIndex(), modelIndex.row(), modelIndex.row());
     }
     mGroups.erase(mGroups.begin() + groupIndex);
     if (!modelResetInProgress()) {
         endRemoveRows();
     }
     return true;
 }
 
 HierarchicalKeyListModel::HierarchicalKeyListModel(QObject *p)
     : AbstractKeyListModel(p)
     , mKeysByFingerprint()
     , mKeysByExistingParent()
     , mKeysByNonExistingParent()
     , mTopLevels()
 {
 }
 
 HierarchicalKeyListModel::~HierarchicalKeyListModel()
 {
 }
 
 int HierarchicalKeyListModel::rowCount(const QModelIndex &pidx) const
 {
     // toplevel item:
     if (!pidx.isValid()) {
         return mTopLevels.size() + mGroups.size();
     }
 
     if (pidx.column() != 0) {
         return 0;
     }
 
     // non-toplevel item - find the number of subjects for this issuer:
     const Key issuer = this->key(pidx);
     const char *const fpr = issuer.primaryFingerprint();
     if (!fpr || !*fpr) {
         return 0;
     }
     const Map::const_iterator it = mKeysByExistingParent.find(fpr);
     if (it == mKeysByExistingParent.end()) {
         return 0;
     }
     return it->second.size();
 }
 
 QModelIndex HierarchicalKeyListModel::index(int row, int col, const QModelIndex &pidx) const
 {
     if (row < 0 || col < 0 || col >= NumColumns) {
         return {};
     }
 
     // toplevel item:
     if (!pidx.isValid()) {
         if (static_cast<unsigned>(row) < mTopLevels.size()) {
             return index(mTopLevels[row], col);
         } else if (static_cast<unsigned>(row) < mTopLevels.size() + mGroups.size()) {
             return index(mGroups[row - mTopLevels.size()], col);
         } else {
             return QModelIndex();
         }
     }
 
     // non-toplevel item - find the row'th subject of this key:
     const Key issuer = this->key(pidx);
     const char *const fpr = issuer.primaryFingerprint();
     if (!fpr || !*fpr) {
         return QModelIndex();
     }
     const Map::const_iterator it = mKeysByExistingParent.find(fpr);
     if (it == mKeysByExistingParent.end() || static_cast<unsigned>(row) >= it->second.size()) {
         return QModelIndex();
     }
     return index(it->second[row], col);
 }
 
 QModelIndex HierarchicalKeyListModel::parent(const QModelIndex &idx) const
 {
     const Key key = this->key(idx);
     if (key.isNull() || key.isRoot()) {
         return {};
     }
     const std::vector<Key>::const_iterator it =
         Kleo::binary_find(mKeysByFingerprint.begin(), mKeysByFingerprint.end(), cleanChainID(key), _detail::ByFingerprint<std::less>());
     return it != mKeysByFingerprint.end() ? index(*it) : QModelIndex();
 }
 
 Key HierarchicalKeyListModel::doMapToKey(const QModelIndex &idx) const
 {
     Key key = Key::null;
 
     if (idx.isValid()) {
         const char *const issuer_fpr = static_cast<const char *>(idx.internalPointer());
         if (!issuer_fpr || !*issuer_fpr) {
             // top-level:
             if (static_cast<unsigned>(idx.row()) < mTopLevels.size()) {
                 key = mTopLevels[idx.row()];
             }
         } else {
             // non-toplevel:
             const Map::const_iterator it = mKeysByExistingParent.find(issuer_fpr);
             if (it != mKeysByExistingParent.end() && static_cast<unsigned>(idx.row()) < it->second.size()) {
                 key = it->second[idx.row()];
             }
         }
     }
 
     return key;
 }
 
 QModelIndex HierarchicalKeyListModel::doMapFromKey(const Key &key, int col) const
 {
     if (key.isNull()) {
         return {};
     }
 
     const char *issuer_fpr = cleanChainID(key);
 
     // we need to look in the toplevels list,...
     const std::vector<Key> *v = &mTopLevels;
     if (issuer_fpr && *issuer_fpr) {
         const std::map<std::string, std::vector<Key>>::const_iterator it = mKeysByExistingParent.find(issuer_fpr);
         // ...unless we find an existing parent:
         if (it != mKeysByExistingParent.end()) {
             v = &it->second;
         } else {
             issuer_fpr = nullptr; // force internalPointer to zero for toplevels
         }
     }
 
     const std::vector<Key>::const_iterator it = std::lower_bound(v->begin(), v->end(), key, _detail::ByFingerprint<std::less>());
     if (it == v->end() || !_detail::ByFingerprint<std::equal_to>()(*it, key)) {
         return QModelIndex();
     }
 
     const unsigned int row = std::distance(v->begin(), it);
     return createIndex(row, col, const_cast<char * /* thanks, Trolls :/ */>(issuer_fpr));
 }
 
 void HierarchicalKeyListModel::addKeyWithParent(const char *issuer_fpr, const Key &key)
 {
     Q_ASSERT(issuer_fpr);
     Q_ASSERT(*issuer_fpr);
     Q_ASSERT(!key.isNull());
 
     std::vector<Key> &subjects = mKeysByExistingParent[issuer_fpr];
 
     // find insertion point:
     const std::vector<Key>::iterator it = std::lower_bound(subjects.begin(), subjects.end(), key, _detail::ByFingerprint<std::less>());
     const int row = std::distance(subjects.begin(), it);
 
     if (it != subjects.end() && qstricmp(it->primaryFingerprint(), key.primaryFingerprint()) == 0) {
         // exists -> replace
         *it = key;
         if (!modelResetInProgress()) {
             Q_EMIT dataChanged(createIndex(row, 0, const_cast<char *>(issuer_fpr)), createIndex(row, NumColumns - 1, const_cast<char *>(issuer_fpr)));
         }
     } else {
         // doesn't exist -> insert
         const std::vector<Key>::const_iterator pos =
             Kleo::binary_find(mKeysByFingerprint.begin(), mKeysByFingerprint.end(), issuer_fpr, _detail::ByFingerprint<std::less>());
         Q_ASSERT(pos != mKeysByFingerprint.end());
         if (!modelResetInProgress()) {
             beginInsertRows(index(*pos), row, row);
         }
         subjects.insert(it, key);
         if (!modelResetInProgress()) {
             endInsertRows();
         }
     }
 }
 
 void HierarchicalKeyListModel::addKeyWithoutParent(const char *issuer_fpr, const Key &key)
 {
     Q_ASSERT(issuer_fpr);
     Q_ASSERT(*issuer_fpr);
     Q_ASSERT(!key.isNull());
 
     std::vector<Key> &subjects = mKeysByNonExistingParent[issuer_fpr];
 
     // find insertion point:
     const std::vector<Key>::iterator it = std::lower_bound(subjects.begin(), subjects.end(), key, _detail::ByFingerprint<std::less>());
 
     if (it != subjects.end() && qstricmp(it->primaryFingerprint(), key.primaryFingerprint()) == 0) {
         // exists -> replace
         *it = key;
     } else {
         // doesn't exist -> insert
         subjects.insert(it, key);
     }
 
     addTopLevelKey(key);
 }
 
 void HierarchicalKeyListModel::addTopLevelKey(const Key &key)
 {
     // find insertion point:
     const std::vector<Key>::iterator it = std::lower_bound(mTopLevels.begin(), mTopLevels.end(), key, _detail::ByFingerprint<std::less>());
     const int row = std::distance(mTopLevels.begin(), it);
 
     if (it != mTopLevels.end() && qstricmp(it->primaryFingerprint(), key.primaryFingerprint()) == 0) {
         // exists -> replace
         *it = key;
         if (!modelResetInProgress()) {
             Q_EMIT dataChanged(createIndex(row, 0), createIndex(row, NumColumns - 1));
         }
     } else {
         // doesn't exist -> insert
         if (!modelResetInProgress()) {
             beginInsertRows(QModelIndex(), row, row);
         }
         mTopLevels.insert(it, key);
         if (!modelResetInProgress()) {
             endInsertRows();
         }
     }
 }
 
 namespace
 {
 
 // based on https://www.boost.org/doc/libs/1_77_0/libs/graph/doc/file_dependency_example.html#sec:cycles
 struct cycle_detector : public boost::dfs_visitor<> {
     cycle_detector(bool &has_cycle)
         : _has_cycle{has_cycle}
     {
     }
 
     template<class Edge, class Graph>
     void back_edge(Edge, Graph &)
     {
         _has_cycle = true;
     }
 
 private:
     bool &_has_cycle;
 };
 
 static bool graph_has_cycle(const boost::adjacency_list<> &graph)
 {
     bool cycle_found = false;
     cycle_detector vis{cycle_found};
     boost::depth_first_search(graph, visitor(vis));
     return cycle_found;
 }
 
 static void find_keys_causing_cycles_and_mask_their_issuers(const std::vector<Key> &keys)
 {
     boost::adjacency_list<> graph{keys.size()};
 
     for (unsigned int i = 0, end = keys.size(); i != end; ++i) {
         const auto &key = keys[i];
         const char *const issuer_fpr = cleanChainID(key);
         if (!issuer_fpr || !*issuer_fpr) {
             continue;
         }
         const std::vector<Key>::const_iterator it = Kleo::binary_find(keys.begin(), keys.end(), issuer_fpr, _detail::ByFingerprint<std::less>());
         if (it == keys.end()) {
             continue;
         }
         const auto j = std::distance(keys.begin(), it);
         const auto edge = boost::add_edge(i, j, graph).first;
         if (graph_has_cycle(graph)) {
             Issuers::instance()->maskIssuerOfKey(key);
             boost::remove_edge(edge, graph);
         }
     }
 }
 
 static auto build_key_graph(const std::vector<Key> &keys)
 {
     boost::adjacency_list<> graph(keys.size());
 
     // add edges from children to parents:
     for (unsigned int i = 0, end = keys.size(); i != end; ++i) {
         const char *const issuer_fpr = cleanChainID(keys[i]);
         if (!issuer_fpr || !*issuer_fpr) {
             continue;
         }
         const std::vector<Key>::const_iterator it = Kleo::binary_find(keys.begin(), keys.end(), issuer_fpr, _detail::ByFingerprint<std::less>());
         if (it == keys.end()) {
             continue;
         }
         const auto j = std::distance(keys.begin(), it);
         add_edge(i, j, graph);
     }
 
     return graph;
 }
 
 // sorts 'keys' such that parent always come before their children:
 static std::vector<Key> topological_sort(const std::vector<Key> &keys)
 {
     const auto graph = build_key_graph(keys);
 
     std::vector<int> order;
     order.reserve(keys.size());
     topological_sort(graph, std::back_inserter(order));
 
     Q_ASSERT(order.size() == keys.size());
 
     std::vector<Key> result;
     result.reserve(keys.size());
     for (int i : std::as_const(order)) {
         result.push_back(keys[i]);
     }
     return result;
 }
 
 }
 
 QList<QModelIndex> HierarchicalKeyListModel::doAddKeys(const std::vector<Key> &keys)
 {
     Q_ASSERT(std::is_sorted(keys.begin(), keys.end(), _detail::ByFingerprint<std::less>()));
 
     if (keys.empty()) {
         return QList<QModelIndex>();
     }
 
     const std::vector<Key> oldKeys = mKeysByFingerprint;
 
     std::vector<Key> merged;
     merged.reserve(keys.size() + mKeysByFingerprint.size());
     std::set_union(keys.begin(),
                    keys.end(),
                    mKeysByFingerprint.begin(),
                    mKeysByFingerprint.end(),
                    std::back_inserter(merged),
                    _detail::ByFingerprint<std::less>());
 
     mKeysByFingerprint = merged;
 
     if (graph_has_cycle(build_key_graph(mKeysByFingerprint))) {
         find_keys_causing_cycles_and_mask_their_issuers(mKeysByFingerprint);
     }
 
     std::set<Key, _detail::ByFingerprint<std::less>> changedParents;
 
     const auto topologicalSortedList = topological_sort(keys);
     for (const Key &key : topologicalSortedList) {
         // check to see whether this key is a parent for a previously parent-less group:
         const char *const fpr = key.primaryFingerprint();
         if (!fpr || !*fpr) {
             continue;
         }
 
         const bool keyAlreadyExisted = std::binary_search(oldKeys.begin(), oldKeys.end(), key, _detail::ByFingerprint<std::less>());
 
         const Map::iterator it = mKeysByNonExistingParent.find(fpr);
         const std::vector<Key> children = it != mKeysByNonExistingParent.end() ? it->second : std::vector<Key>();
         if (it != mKeysByNonExistingParent.end()) {
             mKeysByNonExistingParent.erase(it);
         }
 
         // Step 1: For new keys, remove children from toplevel:
 
         if (!keyAlreadyExisted) {
             auto last = mTopLevels.begin();
             auto lastFP = mKeysByFingerprint.begin();
 
             for (const Key &k : children) {
                 last = Kleo::binary_find(last, mTopLevels.end(), k, _detail::ByFingerprint<std::less>());
                 Q_ASSERT(last != mTopLevels.end());
                 const int row = std::distance(mTopLevels.begin(), last);
 
                 lastFP = Kleo::binary_find(lastFP, mKeysByFingerprint.end(), k, _detail::ByFingerprint<std::less>());
                 Q_ASSERT(lastFP != mKeysByFingerprint.end());
 
                 Q_EMIT rowAboutToBeMoved(QModelIndex(), row);
                 if (!modelResetInProgress()) {
                     beginRemoveRows(QModelIndex(), row, row);
                 }
                 last = mTopLevels.erase(last);
                 lastFP = mKeysByFingerprint.erase(lastFP);
                 if (!modelResetInProgress()) {
                     endRemoveRows();
                 }
             }
         }
         // Step 2: add/update key
 
         const char *const issuer_fpr = cleanChainID(key);
         if (!issuer_fpr || !*issuer_fpr) {
             // root or something...
             addTopLevelKey(key);
         } else if (std::binary_search(mKeysByFingerprint.begin(), mKeysByFingerprint.end(), issuer_fpr, _detail::ByFingerprint<std::less>())) {
             // parent exists...
             addKeyWithParent(issuer_fpr, key);
         } else {
             // parent doesn't exist yet...
             addKeyWithoutParent(issuer_fpr, key);
         }
 
         const QModelIndex key_idx = index(key);
         QModelIndex key_parent = key_idx.parent();
         while (key_parent.isValid()) {
             changedParents.insert(doMapToKey(key_parent));
             key_parent = key_parent.parent();
         }
 
         // Step 3: Add children to new parent ( == key )
 
         if (!keyAlreadyExisted && !children.empty()) {
             addKeys(children);
             const QModelIndex new_parent = index(key);
             // Q_EMIT the rowMoved() signals in reversed direction, so the
             // implementation can use a stack for mapping.
             for (int i = children.size() - 1; i >= 0; --i) {
                 Q_EMIT rowMoved(new_parent, i);
             }
         }
     }
     // Q_EMIT dataChanged for all parents with new children. This triggers KeyListSortFilterProxyModel to
     // show a parent node if it just got children matching the proxy's filter
     if (!modelResetInProgress()) {
         for (const Key &i : std::as_const(changedParents)) {
             const QModelIndex idx = index(i);
             if (idx.isValid()) {
                 Q_EMIT dataChanged(idx.sibling(idx.row(), 0), idx.sibling(idx.row(), NumColumns - 1));
             }
         }
     }
     return indexes(keys);
 }
 
 void HierarchicalKeyListModel::doRemoveKey(const Key &key)
 {
     const QModelIndex idx = index(key);
     if (!idx.isValid()) {
         return;
     }
 
     const char *const fpr = key.primaryFingerprint();
     if (mKeysByExistingParent.find(fpr) != mKeysByExistingParent.end()) {
         // handle non-leave nodes:
         std::vector<Key> keys = mKeysByFingerprint;
         const std::vector<Key>::iterator it = Kleo::binary_find(keys.begin(), keys.end(), key, _detail::ByFingerprint<std::less>());
         if (it == keys.end()) {
             return;
         }
         keys.erase(it);
         // FIXME for simplicity, we just clear the model and re-add all keys minus the removed one. This is suboptimal,
         // but acceptable given that deletion of non-leave nodes is rather rare.
         clear(Keys);
         addKeys(keys);
         return;
     }
 
     // handle leave nodes:
 
     const std::vector<Key>::iterator it = Kleo::binary_find(mKeysByFingerprint.begin(), mKeysByFingerprint.end(), key, _detail::ByFingerprint<std::less>());
 
     Q_ASSERT(it != mKeysByFingerprint.end());
     Q_ASSERT(mKeysByNonExistingParent.find(fpr) == mKeysByNonExistingParent.end());
     Q_ASSERT(mKeysByExistingParent.find(fpr) == mKeysByExistingParent.end());
 
     if (!modelResetInProgress()) {
         beginRemoveRows(parent(idx), idx.row(), idx.row());
     }
     mKeysByFingerprint.erase(it);
 
     const char *const issuer_fpr = cleanChainID(key);
 
     const std::vector<Key>::iterator tlIt = Kleo::binary_find(mTopLevels.begin(), mTopLevels.end(), key, _detail::ByFingerprint<std::less>());
     if (tlIt != mTopLevels.end()) {
         mTopLevels.erase(tlIt);
     }
 
     if (issuer_fpr && *issuer_fpr) {
         const Map::iterator nexIt = mKeysByNonExistingParent.find(issuer_fpr);
         if (nexIt != mKeysByNonExistingParent.end()) {
             const std::vector<Key>::iterator eit = Kleo::binary_find(nexIt->second.begin(), nexIt->second.end(), key, _detail::ByFingerprint<std::less>());
             if (eit != nexIt->second.end()) {
                 nexIt->second.erase(eit);
             }
             if (nexIt->second.empty()) {
                 mKeysByNonExistingParent.erase(nexIt);
             }
         }
 
         const Map::iterator exIt = mKeysByExistingParent.find(issuer_fpr);
         if (exIt != mKeysByExistingParent.end()) {
             const std::vector<Key>::iterator eit = Kleo::binary_find(exIt->second.begin(), exIt->second.end(), key, _detail::ByFingerprint<std::less>());
             if (eit != exIt->second.end()) {
                 exIt->second.erase(eit);
             }
             if (exIt->second.empty()) {
                 mKeysByExistingParent.erase(exIt);
             }
         }
     }
     if (!modelResetInProgress()) {
         endRemoveRows();
     }
 }
 
 KeyGroup HierarchicalKeyListModel::doMapToGroup(const QModelIndex &idx) const
 {
     Q_ASSERT(idx.isValid());
     if (idx.parent().isValid()) {
         // groups are always top-level
         return KeyGroup();
     }
 
     if (static_cast<unsigned>(idx.row()) >= mTopLevels.size() && static_cast<unsigned>(idx.row()) < mTopLevels.size() + mGroups.size()
         && idx.column() < NumColumns) {
         return mGroups[idx.row() - mTopLevels.size()];
     } else {
         return KeyGroup();
     }
 }
 
 QModelIndex HierarchicalKeyListModel::doMapFromGroup(const KeyGroup &group, int column) const
 {
     Q_ASSERT(!group.isNull());
     const auto it = std::find_if(mGroups.cbegin(), mGroups.cend(), [group](const KeyGroup &g) {
         return g.source() == group.source() && g.id() == group.id();
     });
     if (it == mGroups.cend()) {
         return QModelIndex();
     } else {
         return createIndex(it - mGroups.cbegin() + mTopLevels.size(), column);
     }
 }
 
 void HierarchicalKeyListModel::doSetGroups(const std::vector<KeyGroup> &groups)
 {
     Q_ASSERT(mGroups.empty()); // ensure that groups have been cleared
     const int first = mTopLevels.size();
     const int last = first + groups.size() - 1;
     if (!modelResetInProgress()) {
         beginInsertRows(QModelIndex(), first, last);
     }
     mGroups = groups;
     if (!modelResetInProgress()) {
         endInsertRows();
     }
 }
 
 QModelIndex HierarchicalKeyListModel::doAddGroup(const KeyGroup &group)
 {
     const int newRow = lastGroupRow() + 1;
     if (!modelResetInProgress()) {
         beginInsertRows(QModelIndex(), newRow, newRow);
     }
     mGroups.push_back(group);
     if (!modelResetInProgress()) {
         endInsertRows();
     }
     return createIndex(newRow, 0);
 }
 
 bool HierarchicalKeyListModel::doSetGroupData(const QModelIndex &index, const KeyGroup &group)
 {
     if (group.isNull()) {
         return false;
     }
     const int groupIndex = this->groupIndex(index);
     if (groupIndex == -1) {
         return false;
     }
     mGroups[groupIndex] = group;
     if (!modelResetInProgress()) {
         Q_EMIT dataChanged(createIndex(index.row(), 0), createIndex(index.row(), NumColumns - 1));
     }
     return true;
 }
 
 bool HierarchicalKeyListModel::doRemoveGroup(const KeyGroup &group)
 {
     const QModelIndex modelIndex = doMapFromGroup(group, 0);
     if (!modelIndex.isValid()) {
         return false;
     }
     const int groupIndex = this->groupIndex(modelIndex);
     Q_ASSERT(groupIndex != -1);
     if (groupIndex == -1) {
         return false;
     }
     if (!modelResetInProgress()) {
         beginRemoveRows(QModelIndex(), modelIndex.row(), modelIndex.row());
     }
     mGroups.erase(mGroups.begin() + groupIndex);
     if (!modelResetInProgress()) {
         endRemoveRows();
     }
     return true;
 }
 
 void HierarchicalKeyListModel::doClear(ItemTypes types)
 {
     if (types & Keys) {
         mTopLevels.clear();
         mKeysByFingerprint.clear();
         mKeysByExistingParent.clear();
         mKeysByNonExistingParent.clear();
         Issuers::instance()->clear();
     }
     if (types & Groups) {
         mGroups.clear();
     }
 }
 
 void AbstractKeyListModel::useKeyCache(bool value, KeyList::Options options)
 {
     d->m_keyListOptions = options;
     d->m_useKeyCache = value;
     if (!d->m_useKeyCache) {
         clear(All);
     } else {
         d->updateFromKeyCache();
     }
     connect(KeyCache::instance().get(), &KeyCache::keysMayHaveChanged, this, [this] {
         d->updateFromKeyCache();
     });
 }
 
 // static
 AbstractKeyListModel *AbstractKeyListModel::createFlatKeyListModel(QObject *p)
 {
     AbstractKeyListModel *const m = new FlatKeyListModel(p);
 #ifdef KLEO_MODEL_TEST
     new QAbstractItemModelTester(m, p);
 #endif
     return m;
 }
 
 // static
 AbstractKeyListModel *AbstractKeyListModel::createHierarchicalKeyListModel(QObject *p)
 {
     AbstractKeyListModel *const m = new HierarchicalKeyListModel(p);
 #ifdef KLEO_MODEL_TEST
     new QAbstractItemModelTester(m, p);
 #endif
     return m;
 }
 
 QMimeData *AbstractKeyListModel::mimeData(const QModelIndexList &indexes) const
 {
     if (d->m_dragHandler) {
         return d->m_dragHandler->mimeData(indexes);
     } else {
         return QAbstractItemModel::mimeData(indexes);
     }
 }
 
 Qt::ItemFlags AbstractKeyListModel::flags(const QModelIndex &index) const
 {
     if (d->m_dragHandler) {
         return d->m_dragHandler->flags(index);
     } else {
         return QAbstractItemModel::flags(index);
     }
 }
 
 QStringList AbstractKeyListModel::mimeTypes() const
 {
     if (d->m_dragHandler) {
         return d->m_dragHandler->mimeTypes();
     } else {
         return QAbstractItemModel::mimeTypes();
     }
 }
 
 void AbstractKeyListModel::setDragHandler(const std::shared_ptr<DragHandler> &dragHandler)
 {
     d->m_dragHandler = dragHandler;
 }
 
 #include "keylistmodel.moc"
 
 /*!
   \fn AbstractKeyListModel::rowAboutToBeMoved( const QModelIndex & old_parent, int old_row )
 
   Emitted before the removal of a row from that model. It will later
   be added to the model again, in response to which rowMoved() will be
   emitted. If multiple rows are moved in one go, multiple
   rowAboutToBeMoved() signals are emitted before the corresponding
   number of rowMoved() signals is emitted - in reverse order.
 
   This works around the absence of move semantics in
   QAbstractItemModel. Clients can maintain a stack to perform the
   QModelIndex-mapping themselves, or, e.g., to preserve the selection
   status of the row:
 
   \code
   std::vector<bool> mMovingRowWasSelected; // transient, used when rows are moved
   // ...
   void slotRowAboutToBeMoved( const QModelIndex & p, int row ) {
       mMovingRowWasSelected.push_back( selectionModel()->isSelected( model()->index( row, 0, p ) ) );
   }
   void slotRowMoved( const QModelIndex & p, int row ) {
       const bool wasSelected = mMovingRowWasSelected.back();
       mMovingRowWasSelected.pop_back();
       if ( wasSelected )
           selectionModel()->select( model()->index( row, 0, p ), Select|Rows );
   }
   \endcode
 
   A similar mechanism could be used to preserve the current item during moves.
 */
 
 /*!
   \fn AbstractKeyListModel::rowMoved( const QModelIndex & new_parent, int new_parent )
 
   See rowAboutToBeMoved()
 */
 
 #include "moc_keylistmodel.cpp"
diff --git a/src/utils/formatting.cpp b/src/utils/formatting.cpp
index 9f63d71dd..4fbbc40a2 100644
--- a/src/utils/formatting.cpp
+++ b/src/utils/formatting.cpp
@@ -1,1527 +1,1533 @@
 /* -*- mode: c++; c-basic-offset: 4; indent-tabs-mode: nil; -*-
     utils/formatting.cpp
 
     This file is part of Kleopatra, the KDE keymanager
     SPDX-FileCopyrightText: 2007 Klarälvdalens Datakonsult AB
     SPDX-FileCopyrightText: 2021, 2022 g10 Code GmbH
     SPDX-FileContributor: Ingo Klöcker <dev@ingo-kloecker.de>
 
     SPDX-License-Identifier: GPL-2.0-or-later
 */
 
 #include <config-libkleo.h>
 
 #include "formatting.h"
 
 #include "algorithm.h"
 #include "compat.h"
 #include "compliance.h"
 #include "cryptoconfig.h"
 #include "gnupg.h"
 #include "keyhelpers.h"
 
 #include <libkleo/dn.h>
 #include <libkleo/keycache.h>
 #include <libkleo/keygroup.h>
 
 #include <libkleo_debug.h>
 
 #include <KEmailAddress>
 #include <KLocalizedString>
 
 #include <QGpgME/CryptoConfig>
 #include <QGpgME/Protocol>
 
 #include <QDateTime>
 #include <QIcon>
 #include <QLocale>
 #include <QRegularExpression>
 #include <QString>
 
 #include <gpgme++/importresult.h>
 #include <gpgme++/key.h>
 
 #include <gpg-error.h>
 
 using namespace GpgME;
 using namespace Kleo;
 
 namespace
 {
 QIcon iconForValidityAndCompliance(UserID::Validity validity, bool isCompliant)
 {
     switch (validity) {
     case UserID::Ultimate:
     case UserID::Full:
     case UserID::Marginal:
         return isCompliant ? Formatting::successIcon() : Formatting::infoIcon();
     case UserID::Never:
         return Formatting::errorIcon();
     case UserID::Undefined:
     case UserID::Unknown:
     default:
         return Formatting::infoIcon();
     }
 }
 QIcon iconForValidity(const UserID &userId)
 {
     const bool keyIsCompliant = !DeVSCompliance::isActive() || //
         (DeVSCompliance::isCompliant() && DeVSCompliance::keyIsCompliant(userId.parent()));
     return iconForValidityAndCompliance(userId.validity(), keyIsCompliant);
 }
 }
 
 QIcon Formatting::IconProvider::icon(const GpgME::Key &key) const
 {
     return icon(key.userID(0));
 }
 
 QIcon Formatting::IconProvider::icon(const GpgME::UserID &userID) const
 {
     if (usage.canEncrypt() && !Kleo::canBeUsedForEncryption(userID.parent())) {
         return Formatting::errorIcon();
     }
     if (usage.canSign() && !Kleo::canBeUsedForSigning(userID.parent())) {
         return Formatting::errorIcon();
     }
     if (userID.parent().isBad() || userID.isBad()) {
         return Formatting::errorIcon();
     }
     if (Kleo::isRevokedOrExpired(userID)) {
         return Formatting::errorIcon();
     }
     return iconForValidity(userID);
 }
 
 QIcon Formatting::IconProvider::icon(const KeyGroup &group) const
 {
     if (usage.canEncrypt() && !Kleo::all_of(group.keys(), Kleo::canBeUsedForEncryption)) {
         return Formatting::errorIcon();
     }
     if (usage.canSign() && !Kleo::all_of(group.keys(), Kleo::canBeUsedForSigning)) {
         return Formatting::errorIcon();
     }
     return validityIcon(group);
 }
 
 QIcon Formatting::successIcon()
 {
     return QIcon::fromTheme(QStringLiteral("emblem-success"));
 }
 
 QIcon Formatting::infoIcon()
 {
     return QIcon::fromTheme(QStringLiteral("emblem-information"));
 }
 
 QIcon Formatting::questionIcon()
 {
     return QIcon::fromTheme(QStringLiteral("emblem-question"));
 }
 
 QIcon Formatting::unavailableIcon()
 {
     return QIcon::fromTheme(QStringLiteral("emblem-unavailable"));
 }
 
 QIcon Formatting::warningIcon()
 {
     return QIcon::fromTheme(QStringLiteral("emblem-warning"));
 }
 
 QIcon Formatting::errorIcon()
 {
     return QIcon::fromTheme(QStringLiteral("emblem-error"));
 }
 
 //
 // Name
 //
 
 QString Formatting::prettyName(int proto, const char *id, const char *name_, const char *comment_)
 {
     if (proto == GpgME::OpenPGP) {
         const QString name = QString::fromUtf8(name_);
         if (name.isEmpty()) {
             return QString();
         }
         const QString comment = QString::fromUtf8(comment_);
         if (comment.isEmpty()) {
             return name;
         }
         return QStringLiteral("%1 (%2)").arg(name, comment);
     }
 
     if (proto == GpgME::CMS) {
         const DN subject(id);
         const QString cn = subject[QStringLiteral("CN")].trimmed();
         if (cn.isEmpty()) {
             return subject.prettyDN();
         }
         return cn;
     }
 
     return QString();
 }
 
 QString Formatting::prettyNameAndEMail(int proto, const char *id, const char *name_, const char *email_, const char *comment_)
 {
     return prettyNameAndEMail(proto, QString::fromUtf8(id), QString::fromUtf8(name_), prettyEMail(email_, id), QString::fromUtf8(comment_));
 }
 
 QString Formatting::prettyNameAndEMail(int proto, const QString &id, const QString &name, const QString &email, const QString &comment)
 {
     if (proto == GpgME::OpenPGP) {
         if (name.isEmpty()) {
             if (email.isEmpty()) {
                 return QString();
             } else if (comment.isEmpty()) {
                 return QStringLiteral("<%1>").arg(email);
             } else {
                 return QStringLiteral("(%2) <%1>").arg(email, comment);
             }
         }
         if (email.isEmpty()) {
             if (comment.isEmpty()) {
                 return name;
             } else {
                 return QStringLiteral("%1 (%2)").arg(name, comment);
             }
         }
         if (comment.isEmpty()) {
             return QStringLiteral("%1 <%2>").arg(name, email);
         } else {
             return QStringLiteral("%1 (%3) <%2>").arg(name, email, comment);
         }
     }
 
     if (proto == GpgME::CMS) {
         const DN subject(id);
         const QString cn = subject[QStringLiteral("CN")].trimmed();
         if (cn.isEmpty()) {
             return subject.prettyDN();
         }
         return cn;
     }
     return QString();
 }
 
 QString Formatting::prettyUserID(const UserID &uid)
 {
     if (uid.parent().protocol() == GpgME::OpenPGP) {
         return prettyNameAndEMail(uid);
     }
     const QByteArray id = QByteArray(uid.id()).trimmed();
     if (id.startsWith('<')) {
         return prettyEMail(uid.email(), uid.id());
     }
     if (id.startsWith('(')) {
         // ### parse uri/dns:
         return QString::fromUtf8(uid.id());
     } else {
         return DN(uid.id()).prettyDN();
     }
 }
 
 QString Formatting::prettyKeyID(const char *id)
 {
     if (!id) {
         return QString();
     }
     return QLatin1StringView("0x") + QString::fromLatin1(id).toUpper();
 }
 
 QString Formatting::prettyNameAndEMail(const UserID &uid)
 {
     return prettyNameAndEMail(uid.parent().protocol(), uid.id(), uid.name(), uid.email(), uid.comment());
 }
 
 QString Formatting::prettyNameAndEMail(const Key &key)
 {
     return prettyNameAndEMail(key.userID(0));
 }
 
 QString Formatting::prettyName(const Key &key)
 {
     return prettyName(key.userID(0));
 }
 
 QString Formatting::prettyName(const UserID &uid)
 {
     return prettyName(uid.parent().protocol(), uid.id(), uid.name(), uid.comment());
 }
 
 QString Formatting::prettyName(const UserID::Signature &sig)
 {
     return prettyName(GpgME::OpenPGP, sig.signerUserID(), sig.signerName(), sig.signerComment());
 }
 
 //
 // EMail
 //
 
 QString Formatting::prettyEMail(const Key &key)
 {
     for (unsigned int i = 0, end = key.numUserIDs(); i < end; ++i) {
         const QString email = prettyEMail(key.userID(i));
         if (!email.isEmpty()) {
             return email;
         }
     }
     return QString();
 }
 
 QString Formatting::prettyEMail(const UserID &uid)
 {
     return prettyEMail(uid.email(), uid.id());
 }
 
 QString Formatting::prettyEMail(const UserID::Signature &sig)
 {
     return prettyEMail(sig.signerEmail(), sig.signerUserID());
 }
 
 QString Formatting::prettyEMail(const char *email_, const char *id)
 {
     QString email;
     QString name;
     QString comment;
     if (email_ && KEmailAddress::splitAddress(QString::fromUtf8(email_), name, email, comment) == KEmailAddress::AddressOk) {
         return email;
     } else {
         return DN(id)[QStringLiteral("EMAIL")].trimmed();
     }
 }
 
 //
 // Tooltip
 //
 
 namespace
 {
 
 static QString protect_whitespace(QString s)
 {
     static const QLatin1Char SP(' ');
     static const QLatin1Char NBSP('\xA0');
     return s.replace(SP, NBSP);
 }
 
 template<typename T_arg>
 QString format_row(const QString &field, const T_arg &arg)
 {
     return QStringLiteral("<tr><th>%1:</th><td>%2</td></tr>").arg(protect_whitespace(field), arg);
 }
 QString format_row(const QString &field, const QString &arg)
 {
     return QStringLiteral("<tr><th>%1:</th><td>%2</td></tr>").arg(protect_whitespace(field), arg.toHtmlEscaped());
 }
 QString format_row(const QString &field, const char *arg)
 {
     return format_row(field, QString::fromUtf8(arg));
 }
 
 QString format_keytype(const Key &key)
 {
     const Subkey subkey = key.subkey(0);
     if (key.hasSecret()) {
         return i18n("%1-bit %2 (secret key available)", subkey.length(), QLatin1StringView(subkey.publicKeyAlgorithmAsString()));
     } else {
         return i18n("%1-bit %2", subkey.length(), QLatin1StringView(subkey.publicKeyAlgorithmAsString()));
     }
 }
 
 QString format_subkeytype(const Subkey &subkey)
 {
     const auto algo = subkey.publicKeyAlgorithm();
 
     if (algo == Subkey::AlgoECC || algo == Subkey::AlgoECDSA || algo == Subkey::AlgoECDH || algo == Subkey::AlgoEDDSA) {
         return QString::fromStdString(subkey.algoName());
     }
     return i18n("%1-bit %2", subkey.length(), QLatin1StringView(subkey.publicKeyAlgorithmAsString()));
 }
 
 QString format_keyusage(const Key &key)
 {
     QStringList capabilities;
     if (Kleo::keyHasSign(key)) {
         if (key.isQualified()) {
             capabilities.push_back(i18n("Signing (Qualified)"));
         } else {
             capabilities.push_back(i18n("Signing"));
         }
     }
     if (Kleo::keyHasEncrypt(key)) {
         capabilities.push_back(i18n("Encryption"));
     }
     if (Kleo::keyHasCertify(key)) {
         capabilities.push_back(i18n("Certifying User-IDs"));
     }
     if (Kleo::keyHasAuthenticate(key)) {
         capabilities.push_back(i18n("SSH Authentication"));
     }
     return capabilities.join(QLatin1StringView(", "));
 }
 
 QString format_subkeyusage(const Subkey &subkey)
 {
     QStringList capabilities;
     if (subkey.canSign()) {
         if (subkey.isQualified()) {
             capabilities.push_back(i18n("Signing (Qualified)"));
         } else {
             capabilities.push_back(i18n("Signing"));
         }
     }
     if (subkey.canEncrypt()) {
         capabilities.push_back(i18n("Encryption"));
     }
     if (subkey.canCertify()) {
         capabilities.push_back(i18n("Certifying User-IDs"));
     }
     if (subkey.canAuthenticate()) {
         capabilities.push_back(i18n("SSH Authentication"));
     }
     return capabilities.join(QLatin1StringView(", "));
 }
 
 static QString time_t2string(time_t t)
 {
     const QDateTime dt = QDateTime::fromSecsSinceEpoch(quint32(t));
     return QLocale().toString(dt, QLocale::ShortFormat);
 }
 
 static QString make_red(const QString &txt)
 {
     return QLatin1StringView("<font color=\"red\">") + txt.toHtmlEscaped() + QLatin1String("</font>");
 }
 
 }
 
 static QString toolTipInternal(const GpgME::Key &key, const GpgME::UserID &userID, int flags)
 {
     if (flags == 0 || (key.protocol() != GpgME::CMS && key.protocol() != GpgME::OpenPGP)) {
         return QString();
     }
 
     const Subkey subkey = key.subkey(0);
 
     QString result;
     if (flags & Formatting::Validity) {
         if (key.protocol() == GpgME::OpenPGP || (key.keyListMode() & Validate)) {
             if (userID.isRevoked() || key.isRevoked()) {
                 result = make_red(i18n("Revoked"));
             } else if (key.isExpired()) {
                 result = make_red(i18n("Expired"));
             } else if (key.isDisabled()) {
                 result = i18n("Disabled");
             } else if (key.keyListMode() & GpgME::Validate) {
                 if (!userID.isNull()) {
                     if (userID.validity() >= UserID::Validity::Full) {
                         result = i18n("User-ID is certified.");
                         const auto compliance = Formatting::complianceStringForUserID(userID);
                         if (!compliance.isEmpty()) {
                             result += QStringLiteral("<br>") + compliance;
                         }
                     } else {
                         result = i18n("User-ID is not certified.");
                     }
                 } else {
                     unsigned int fullyTrusted = 0;
                     for (const auto &uid : key.userIDs()) {
                         if (uid.validity() >= UserID::Validity::Full) {
                             fullyTrusted++;
                         }
                     }
                     if (fullyTrusted == key.numUserIDs()) {
                         result = i18n("All User-IDs are certified.");
                         const auto compliance = Formatting::complianceStringForKey(key);
                         if (!compliance.isEmpty()) {
                             result += QStringLiteral("<br>") + compliance;
                         }
                     } else {
                         result = i18np("One User-ID is not certified.", "%1 User-IDs are not certified.", key.numUserIDs() - fullyTrusted);
                     }
                 }
             } else {
                 result = i18n("The validity cannot be checked at the moment.");
             }
         } else {
             result = i18n("The validity cannot be checked at the moment.");
         }
     }
     if (flags == Formatting::Validity) {
         return result;
     }
 
     result += QLatin1StringView("<table border=\"0\">");
     if (key.protocol() == GpgME::CMS) {
         if (flags & Formatting::SerialNumber) {
             result += format_row(i18n("Serial number"), key.issuerSerial());
         }
         if (flags & Formatting::Issuer) {
             result += format_row(i18n("Issuer"), key.issuerName());
         }
     }
     if (flags & Formatting::UserIDs) {
         if (userID.isNull()) {
             const std::vector<UserID> uids = key.userIDs();
             if (!uids.empty()) {
                 result += format_row(key.protocol() == GpgME::CMS ? i18n("Subject") : i18n("User-ID"), Formatting::prettyUserID(uids.front()));
             }
             if (uids.size() > 1) {
                 for (auto it = uids.begin() + 1, end = uids.end(); it != end; ++it) {
                     if (!it->isRevoked() && !it->isInvalid()) {
                         result += format_row(i18n("a.k.a."), Formatting::prettyUserID(*it));
                     }
                 }
             }
         } else {
             result += format_row(key.protocol() == GpgME::CMS ? i18n("Subject") : i18n("User-ID"), Formatting::prettyUserID(userID));
         }
     }
     if (flags & Formatting::ExpiryDates) {
         result += format_row(i18n("Valid from"), time_t2string(subkey.creationTime()));
 
         if (!subkey.neverExpires()) {
             result += format_row(i18n("Valid until"), time_t2string(subkey.expirationTime()));
         }
     }
 
     if (flags & Formatting::CertificateType) {
         result += format_row(i18n("Type"), format_keytype(key));
     }
     if (flags & Formatting::CertificateUsage) {
         result += format_row(i18n("Usage"), format_keyusage(key));
     }
     if (flags & Formatting::KeyID) {
         result += format_row(i18n("Key-ID"), QString::fromLatin1(key.shortKeyID()));
     }
     if (flags & Formatting::Fingerprint) {
         result += format_row(i18n("Fingerprint"), key.primaryFingerprint());
     }
     if (flags & Formatting::OwnerTrust) {
         if (key.protocol() == GpgME::OpenPGP) {
             result += format_row(i18n("Certification trust"), Formatting::ownerTrustShort(key));
         } else if (key.isRoot()) {
             result += format_row(i18n("Trusted issuer?"), (userID.isNull() ? key.userID(0) : userID).validity() == UserID::Ultimate ? i18n("Yes") : i18n("No"));
         }
     }
     if (flags & Formatting::StorageLocation) {
         if (const char *card = subkey.cardSerialNumber()) {
             result += format_row(i18n("Stored"), i18nc("stored...", "on SmartCard with serial no. %1", QString::fromUtf8(card)));
         } else {
             result += format_row(i18n("Stored"), i18nc("stored...", "on this computer"));
         }
     }
     if (flags & Formatting::Subkeys) {
         for (const auto &sub : key.subkeys()) {
             result += QLatin1StringView("<hr/>");
             result += format_row(i18n("Subkey"), sub.fingerprint());
             if (sub.isRevoked()) {
                 result += format_row(i18n("Status"), i18n("Revoked"));
             } else if (sub.isExpired()) {
                 result += format_row(i18n("Status"), i18n("Expired"));
             }
             if (flags & Formatting::ExpiryDates) {
                 result += format_row(i18n("Valid from"), time_t2string(sub.creationTime()));
 
                 if (!sub.neverExpires()) {
                     result += format_row(i18n("Valid until"), time_t2string(sub.expirationTime()));
                 }
             }
 
             if (flags & Formatting::CertificateType) {
                 result += format_row(i18n("Type"), format_subkeytype(sub));
             }
             if (flags & Formatting::CertificateUsage) {
                 result += format_row(i18n("Usage"), format_subkeyusage(sub));
             }
             if (flags & Formatting::StorageLocation) {
                 if (const char *card = sub.cardSerialNumber()) {
                     result += format_row(i18n("Stored"), i18nc("stored...", "on SmartCard with serial no. %1", QString::fromUtf8(card)));
                 } else {
                     result += format_row(i18n("Stored"), i18nc("stored...", "on this computer"));
                 }
             }
         }
     }
     result += QLatin1StringView("</table>");
 
     return result;
 }
 
 QString Formatting::toolTip(const Key &key, int flags)
 {
     return toolTipInternal(key, UserID(), flags);
 }
 
 namespace
 {
 template<typename Container>
 QString getValidityStatement(const Container &keys)
 {
     const bool allKeysAreOpenPGP = std::all_of(keys.cbegin(), keys.cend(), [](const Key &key) {
         return key.protocol() == GpgME::OpenPGP;
     });
     const bool allKeysAreValidated = std::all_of(keys.cbegin(), keys.cend(), [](const Key &key) {
         return key.keyListMode() & Validate;
     });
     if (allKeysAreOpenPGP || allKeysAreValidated) {
         const bool someKeysAreBad = std::any_of(keys.cbegin(), keys.cend(), std::mem_fn(&Key::isBad));
         if (someKeysAreBad) {
             return i18n("Some keys are revoked, expired, disabled, or invalid.");
         } else {
             const bool allKeysAreFullyValid = std::all_of(keys.cbegin(), keys.cend(), &Kleo::allUserIDsHaveFullValidity);
             if (allKeysAreFullyValid) {
                 return i18n("All keys are certified.");
             } else {
                 return i18n("Some keys are not certified.");
             }
         }
     }
     return i18n("The validity of the keys cannot be checked at the moment.");
 }
 }
 
 QString Formatting::toolTip(const KeyGroup &group, int flags)
 {
     static const unsigned int maxNumKeysForTooltip = 20;
 
     if (group.isNull()) {
         return QString();
     }
 
     const KeyGroup::Keys &keys = group.keys();
     if (keys.size() == 0) {
         return i18nc("@info:tooltip", "This group does not contain any keys.");
     }
 
+    if (Kleo::any_of(keys, [](const auto &key) {
+            return !key.hasEncrypt();
+        })) {
+        return i18nc("@info:tooltip", "Some of the certificates in this group cannot be used for encryption. Using this group can lead to unexpected results.");
+    }
+
     const QString validity = (flags & Validity) ? getValidityStatement(keys) : QString();
     if (flags == Validity) {
         return validity;
     }
 
     // list either up to maxNumKeysForTooltip keys or (maxNumKeysForTooltip-1) keys followed by "and n more keys"
     const unsigned int numKeysForTooltip = keys.size() > maxNumKeysForTooltip ? maxNumKeysForTooltip - 1 : keys.size();
 
     QStringList result;
     result.reserve(3 + 2 + numKeysForTooltip + 2);
     if (!validity.isEmpty()) {
         result.push_back(QStringLiteral("<p>"));
         result.push_back(validity.toHtmlEscaped());
         result.push_back(QStringLiteral("</p>"));
     }
 
     result.push_back(QStringLiteral("<p>"));
     result.push_back(i18n("Keys:"));
     {
         auto it = keys.cbegin();
         for (unsigned int i = 0; i < numKeysForTooltip; ++i, ++it) {
             result.push_back(QLatin1StringView("<br>") + Formatting::summaryLine(*it).toHtmlEscaped());
         }
     }
     if (keys.size() > numKeysForTooltip) {
         result.push_back(QLatin1StringView("<br>")
                          + i18ncp("this follows a list of keys", "and 1 more key", "and %1 more keys", keys.size() - numKeysForTooltip));
     }
     result.push_back(QStringLiteral("</p>"));
 
     return result.join(QLatin1Char('\n'));
 }
 
 QString Formatting::toolTip(const UserID &userID, int flags)
 {
     return toolTipInternal(userID.parent(), userID, flags);
 }
 
 //
 // Creation and Expiration
 //
 
 namespace
 {
 static QDate time_t2date(time_t t)
 {
     if (!t) {
         return {};
     }
     const QDateTime dt = QDateTime::fromSecsSinceEpoch(quint32(t));
     return dt.date();
 }
 static QString accessible_date_format()
 {
     return i18nc(
         "date format suitable for screen readers; "
         "d: day as a number without a leading zero, "
         "MMMM: localized month name, "
         "yyyy: year as a four digit number",
         "MMMM d, yyyy");
 }
 
 template<typename T>
 QString expiration_date_string(const T &tee, const QString &noExpiration)
 {
     return tee.neverExpires() ? noExpiration : Formatting::dateString(time_t2date(tee.expirationTime()));
 }
 template<typename T>
 QDate creation_date(const T &tee)
 {
     return time_t2date(tee.creationTime());
 }
 template<typename T>
 QDate expiration_date(const T &tee)
 {
     return time_t2date(tee.expirationTime());
 }
 }
 
 QString Formatting::dateString(time_t t)
 {
     return dateString(time_t2date(t));
 }
 
 QString Formatting::dateString(const QDate &date)
 {
     return QLocale().toString(date, QLocale::ShortFormat);
 }
 
 QString Formatting::accessibleDate(time_t t)
 {
     return accessibleDate(time_t2date(t));
 }
 
 QString Formatting::accessibleDate(const QDate &date)
 {
     return QLocale().toString(date, accessible_date_format());
 }
 
 QString Formatting::expirationDateString(const Key &key, const QString &noExpiration)
 {
     // if key is remote but has a non-zero expiration date (e.g. a key looked up via WKD),
     // then we assume that the date is valid; if the date is zero for a remote key, then
     // we don't know if it's unknown or unlimited
     return isRemoteKey(key) && (key.subkey(0).expirationTime() == 0) //
         ? i18nc("@info the expiration date of the key is unknown", "unknown")
         : expiration_date_string(key.subkey(0), noExpiration);
 }
 
 QString Formatting::expirationDateString(const Subkey &subkey, const QString &noExpiration)
 {
     return expiration_date_string(subkey, noExpiration);
 }
 
 QString Formatting::expirationDateString(const UserID::Signature &sig, const QString &noExpiration)
 {
     return expiration_date_string(sig, noExpiration);
 }
 
 QDate Formatting::expirationDate(const Key &key)
 {
     return expiration_date(key.subkey(0));
 }
 
 QDate Formatting::expirationDate(const Subkey &subkey)
 {
     return expiration_date(subkey);
 }
 
 QDate Formatting::expirationDate(const UserID::Signature &sig)
 {
     return expiration_date(sig);
 }
 
 QString Formatting::accessibleExpirationDate(const Key &key, const QString &noExpiration)
 {
     // if key is remote but has a non-zero expiration date (e.g. a key looked up via WKD),
     // then we assume that the date is valid; if the date is zero for a remote key, then
     // we don't know if it's unknown or unlimited
     return isRemoteKey(key) && (key.subkey(0).expirationTime() == 0) //
         ? i18nc("@info the expiration date of the key is unknown", "unknown")
         : accessibleExpirationDate(key.subkey(0), noExpiration);
 }
 
 QString Formatting::accessibleExpirationDate(const Subkey &subkey, const QString &noExpiration)
 {
     if (subkey.neverExpires()) {
         return noExpiration.isEmpty() ? i18n("unlimited") : noExpiration;
     } else {
         return accessibleDate(expirationDate(subkey));
     }
 }
 
 QString Formatting::accessibleExpirationDate(const UserID::Signature &sig, const QString &noExpiration)
 {
     if (sig.neverExpires()) {
         return noExpiration.isEmpty() ? i18n("unlimited") : noExpiration;
     } else {
         return accessibleDate(expirationDate(sig));
     }
 }
 
 QString Formatting::creationDateString(const Key &key)
 {
     return dateString(creation_date(key.subkey(0)));
 }
 
 QString Formatting::creationDateString(const Subkey &subkey)
 {
     return dateString(creation_date(subkey));
 }
 
 QString Formatting::creationDateString(const UserID::Signature &sig)
 {
     return dateString(creation_date(sig));
 }
 
 QDate Formatting::creationDate(const Key &key)
 {
     return creation_date(key.subkey(0));
 }
 
 QDate Formatting::creationDate(const Subkey &subkey)
 {
     return creation_date(subkey);
 }
 
 QDate Formatting::creationDate(const UserID::Signature &sig)
 {
     return creation_date(sig);
 }
 
 QString Formatting::accessibleCreationDate(const Key &key)
 {
     return accessibleDate(creationDate(key));
 }
 
 QString Formatting::accessibleCreationDate(const Subkey &subkey)
 {
     return accessibleDate(creationDate(subkey));
 }
 
 //
 // Types
 //
 
 QString Formatting::displayName(GpgME::Protocol p)
 {
     if (p == GpgME::CMS) {
         return i18nc("X.509/CMS encryption standard", "S/MIME");
     }
     if (p == GpgME::OpenPGP) {
         return i18n("OpenPGP");
     }
     return i18nc("Unknown encryption protocol", "Unknown");
 }
 
 QString Formatting::type(const Key &key)
 {
     return displayName(key.protocol());
 }
 
 QString Formatting::type(const Subkey &subkey)
 {
     return QString::fromUtf8(subkey.publicKeyAlgorithmAsString());
 }
 
 QString Formatting::type(const KeyGroup &group)
 {
     Q_UNUSED(group)
     return i18nc("a group of keys/certificates", "Group");
 }
 
 //
 // Status / Validity
 //
 
 QString Formatting::ownerTrustShort(const Key &key)
 {
     return ownerTrustShort(key.ownerTrust());
 }
 
 QString Formatting::ownerTrustShort(Key::OwnerTrust trust)
 {
     switch (trust) {
     case Key::Unknown:
         return i18nc("unknown trust level", "unknown");
     case Key::Never:
         return i18n("untrusted");
     case Key::Marginal:
         return i18nc("marginal trust", "marginal");
     case Key::Full:
         return i18nc("full trust", "full");
     case Key::Ultimate:
         return i18nc("ultimate trust", "ultimate");
     case Key::Undefined:
         return i18nc("undefined trust", "undefined");
     default:
         Q_ASSERT(!"unexpected owner trust value");
         break;
     }
     return QString();
 }
 
 QString Formatting::validityShort(const Subkey &subkey)
 {
     if (subkey.isRevoked()) {
         return i18n("revoked");
     }
     if (subkey.isExpired()) {
         return i18n("expired");
     }
     if (subkey.isDisabled()) {
         return i18n("disabled");
     }
     if (subkey.isInvalid()) {
         return i18n("invalid");
     }
     return i18nc("as in good/valid signature", "good");
 }
 
 QString Formatting::validityShort(const UserID &uid)
 {
     if (uid.isRevoked()) {
         return i18n("revoked");
     }
     if (uid.isInvalid()) {
         return i18n("invalid");
     }
     switch (uid.validity()) {
     case UserID::Unknown:
         return i18nc("unknown trust level", "unknown");
     case UserID::Undefined:
         return i18nc("undefined trust", "undefined");
     case UserID::Never:
         return i18n("untrusted");
     case UserID::Marginal:
         return i18nc("marginal trust", "marginal");
     case UserID::Full:
         return i18nc("full trust", "full");
     case UserID::Ultimate:
         return i18nc("ultimate trust", "ultimate");
     }
     return QString();
 }
 
 QString Formatting::validityShort(const UserID::Signature &sig)
 {
     switch (sig.status()) {
     case UserID::Signature::NoError:
         if (!sig.isInvalid()) {
             /* See RFC 4880 Section 5.2.1 */
             switch (sig.certClass()) {
             case 0x10: /* Generic */
             case 0x11: /* Persona */
             case 0x12: /* Casual */
             case 0x13: /* Positive */
                 return i18n("valid");
             case 0x30:
                 return i18n("revoked");
             default:
                 return i18n("class %1", sig.certClass());
             }
         }
         [[fallthrough]];
         // fall through:
     case UserID::Signature::GeneralError:
         return i18n("invalid");
     case UserID::Signature::SigExpired:
         return i18n("expired");
     case UserID::Signature::KeyExpired:
         return i18n("certificate expired");
     case UserID::Signature::BadSignature:
         return i18nc("fake/invalid signature", "bad");
     case UserID::Signature::NoPublicKey: {
         /* GnuPG returns the same error for no public key as for expired
          * or revoked certificates. */
         const auto key = KeyCache::instance()->findByKeyIDOrFingerprint(sig.signerKeyID());
         if (key.isNull()) {
             return i18n("no public key");
         } else if (key.isExpired()) {
             return i18n("key expired");
         } else if (key.isRevoked()) {
             return i18n("key revoked");
         } else if (key.isDisabled()) {
             return i18n("key disabled");
         }
         /* can't happen */
         return QStringLiteral("unknown");
     }
     }
     return QString();
 }
 
 QIcon Formatting::validityIcon(const UserID::Signature &sig)
 {
     switch (sig.status()) {
     case UserID::Signature::NoError:
         if (!sig.isInvalid()) {
             /* See RFC 4880 Section 5.2.1 */
             switch (sig.certClass()) {
             case 0x10: /* Generic */
             case 0x11: /* Persona */
             case 0x12: /* Casual */
             case 0x13: /* Positive */
                 return Formatting::successIcon();
             case 0x30:
                 return Formatting::errorIcon();
             default:
                 return QIcon();
             }
         }
         [[fallthrough]];
         // fall through:
     case UserID::Signature::BadSignature:
     case UserID::Signature::GeneralError:
         return Formatting::errorIcon();
     case UserID::Signature::SigExpired:
     case UserID::Signature::KeyExpired:
         return Formatting::infoIcon();
     case UserID::Signature::NoPublicKey:
         return Formatting::questionIcon();
     }
     return QIcon();
 }
 
 QString Formatting::formatKeyLink(const Key &key)
 {
     if (key.isNull()) {
         return QString();
     }
     return QStringLiteral("<a href=\"key:%1\">%2</a>").arg(QLatin1StringView(key.primaryFingerprint()), Formatting::prettyName(key));
 }
 
 QString Formatting::formatForComboBox(const GpgME::Key &key)
 {
     const QString name = prettyName(key);
     QString mail = prettyEMail(key);
     if (!mail.isEmpty()) {
         mail = QLatin1Char('<') + mail + QLatin1Char('>');
     }
     return i18nc("name, email, key id", "%1 %2 (%3)", name, mail, QLatin1StringView(key.shortKeyID())).simplified();
 }
 
 QString Formatting::nameAndEmailForSummaryLine(const UserID &id)
 {
     Q_ASSERT(!id.isNull());
 
     const QString email = Formatting::prettyEMail(id);
     const QString name = Formatting::prettyName(id);
 
     if (name.isEmpty()) {
         return email;
     } else if (email.isEmpty()) {
         return name;
     } else {
         return QStringLiteral("%1 <%2>").arg(name, email);
     }
 }
 
 QString Formatting::nameAndEmailForSummaryLine(const Key &key)
 {
     Q_ASSERT(!key.isNull());
 
     const QString email = Formatting::prettyEMail(key);
     const QString name = Formatting::prettyName(key);
 
     if (name.isEmpty()) {
         return email;
     } else if (email.isEmpty()) {
         return name;
     } else {
         return QStringLiteral("%1 <%2>").arg(name, email);
     }
 }
 
 const char *Formatting::summaryToString(const Signature::Summary summary)
 {
     if (summary & Signature::Red) {
         return "RED";
     }
     if (summary & Signature::Green) {
         return "GREEN";
     }
     return "YELLOW";
 }
 
 QString Formatting::signatureToString(const Signature &sig, const Key &key)
 {
     if (sig.isNull()) {
         return QString();
     }
 
     const bool red = (sig.summary() & Signature::Red);
     const bool valid = (sig.summary() & Signature::Valid);
 
     if (red) {
         if (key.isNull()) {
             if (const char *fpr = sig.fingerprint()) {
                 return i18n("Bad signature by unknown certificate %1: %2", QString::fromLatin1(fpr), Formatting::errorAsString(sig.status()));
             } else {
                 return i18n("Bad signature by an unknown certificate: %1", Formatting::errorAsString(sig.status()));
             }
         } else {
             return i18n("Bad signature by %1: %2", nameAndEmailForSummaryLine(key), Formatting::errorAsString(sig.status()));
         }
 
     } else if (valid) {
         if (key.isNull()) {
             if (const char *fpr = sig.fingerprint()) {
                 return i18n("Good signature by unknown certificate %1.", QString::fromLatin1(fpr));
             } else {
                 return i18n("Good signature by an unknown certificate.");
             }
         } else {
             return i18n("Good signature by %1.", nameAndEmailForSummaryLine(key));
         }
 
     } else if (key.isNull()) {
         if (const char *fpr = sig.fingerprint()) {
             return i18n("Invalid signature by unknown certificate %1: %2", QString::fromLatin1(fpr), Formatting::errorAsString(sig.status()));
         } else {
             return i18n("Invalid signature by an unknown certificate: %1", Formatting::errorAsString(sig.status()));
         }
     } else {
         return i18n("Invalid signature by %1: %2", nameAndEmailForSummaryLine(key), Formatting::errorAsString(sig.status()));
     }
 }
 
 //
 // ImportResult
 //
 
 QString Formatting::importMetaData(const Import &import, const QStringList &ids)
 {
     const QString result = importMetaData(import);
     if (result.isEmpty()) {
         return QString();
     } else {
         return result + QLatin1Char('\n') + i18n("This certificate was imported from the following sources:") + QLatin1Char('\n') + ids.join(QLatin1Char('\n'));
     }
 }
 
 QString Formatting::importMetaData(const Import &import)
 {
     if (import.isNull()) {
         return QString();
     }
 
     if (import.error().isCanceled()) {
         return i18n("The import of this certificate was canceled.");
     }
     if (import.error()) {
         return i18n("An error occurred importing this certificate: %1", Formatting::errorAsString(import.error()));
     }
 
     const unsigned int status = import.status();
     if (status & Import::NewKey) {
         return (status & Import::ContainedSecretKey) ? i18n("This certificate was new to your keystore. The secret key is available.")
                                                      : i18n("This certificate is new to your keystore.");
     }
 
     QStringList results;
     if (status & Import::NewUserIDs) {
         results.push_back(i18n("New user-ids were added to this certificate by the import."));
     }
     if (status & Import::NewSignatures) {
         results.push_back(i18n("New signatures were added to this certificate by the import."));
     }
     if (status & Import::NewSubkeys) {
         results.push_back(i18n("New subkeys were added to this certificate by the import."));
     }
 
     return results.empty() ? i18n("The import contained no new data for this certificate. It is unchanged.") : results.join(QLatin1Char('\n'));
 }
 
 //
 // Overview in CertificateDetailsDialog
 //
 
 QString Formatting::formatOverview(const Key &key)
 {
     return toolTip(key, AllOptions);
 }
 
 QString Formatting::usageString(const Subkey &sub)
 {
     QStringList usageStrings;
     if (sub.canCertify()) {
         usageStrings << i18n("Certify");
     }
     if (sub.canSign()) {
         usageStrings << i18n("Sign");
     }
     if (sub.canEncrypt()) {
         usageStrings << i18n("Encrypt");
     }
     if (sub.canAuthenticate()) {
         usageStrings << i18n("Authenticate");
     }
     if (sub.canRenc()) {
         usageStrings << i18nc("Means 'Additional Decryption Subkey'; Don't try translating that, though.", "ADSK");
     }
     return usageStrings.join(QLatin1StringView(", "));
 }
 
 QString Formatting::summaryLine(const UserID &id)
 {
     return i18nc("name <email> (validity, protocol, creation date)",
                  "%1 (%2, %3, created: %4)",
                  nameAndEmailForSummaryLine(id),
                  Formatting::complianceStringShort(id),
                  displayName(id.parent().protocol()),
                  Formatting::creationDateString(id.parent()));
 }
 
 QString Formatting::summaryLine(const Key &key)
 {
     return nameAndEmailForSummaryLine(key) + QLatin1Char(' ')
         + i18nc("(validity, protocol, creation date)",
                 "(%1, %2, created: %3)",
                 Formatting::complianceStringShort(key),
                 displayName(key.protocol()),
                 Formatting::creationDateString(key));
 }
 
 QString Formatting::summaryLine(const KeyGroup &group)
 {
     switch (group.source()) {
     case KeyGroup::ApplicationConfig:
     case KeyGroup::GnuPGConfig:
         return i18ncp("name of group of keys (n key(s), validity)",
                       "%2 (1 key, %3)",
                       "%2 (%1 keys, %3)",
                       group.keys().size(),
                       group.name(),
                       Formatting::complianceStringShort(group));
     case KeyGroup::Tags:
         return i18ncp("name of group of keys (n key(s), validity, tag)",
                       "%2 (1 key, %3, tag)",
                       "%2 (%1 keys, %3, tag)",
                       group.keys().size(),
                       group.name(),
                       Formatting::complianceStringShort(group));
     default:
         return i18ncp("name of group of keys (n key(s), validity, group ...)",
                       "%2 (1 key, %3, unknown origin)",
                       "%2 (%1 keys, %3, unknown origin)",
                       group.keys().size(),
                       group.name(),
                       Formatting::complianceStringShort(group));
     }
 }
 
 // Icon for certificate selection indication
 QIcon Formatting::iconForUid(const UserID &uid)
 {
     if (Kleo::isRevokedOrExpired(uid)) {
         return Formatting::errorIcon();
     }
     return iconForValidity(uid);
 }
 
 QString Formatting::validity(const UserID &uid)
 {
     switch (uid.validity()) {
     case UserID::Ultimate:
         return i18n("The certificate is marked as your own.");
     case UserID::Full:
         return i18n("The certificate belongs to this recipient.");
     case UserID::Marginal:
         return i18n("The trust model indicates marginally that the certificate belongs to this recipient.");
     case UserID::Never:
         return i18n("This certificate should not be used.");
     case UserID::Undefined:
     case UserID::Unknown:
     default:
         return i18n("There is no indication that this certificate belongs to this recipient.");
     }
 }
 
 QString Formatting::validity(const KeyGroup &group)
 {
     if (group.isNull()) {
         return QString();
     }
 
     const KeyGroup::Keys &keys = group.keys();
     if (keys.size() == 0) {
         return i18n("This group does not contain any keys.");
     }
 
     return getValidityStatement(keys);
 }
 
 namespace
 {
 template<typename Container>
 UserID::Validity minimalValidity(const Container &keys)
 {
     const int minValidity = std::accumulate(keys.cbegin(), keys.cend(), UserID::Ultimate + 1, [](int validity, const Key &key) {
         return std::min<int>(validity, minimalValidityOfNotRevokedUserIDs(key));
     });
     return minValidity <= UserID::Ultimate ? static_cast<UserID::Validity>(minValidity) : UserID::Unknown;
 }
 
 template<typename Container>
 bool allKeysAreCompliant(const Container &keys)
 {
     if (!DeVSCompliance::isActive()) {
         return true;
     }
     if (!DeVSCompliance::isCompliant()) {
         return false;
     }
     return Kleo::all_of(keys, DeVSCompliance::keyIsCompliant);
 }
 }
 
 QIcon Formatting::validityIcon(const KeyGroup &group)
 {
     if (Kleo::any_of(group.keys(), std::mem_fn(&Key::isBad))) {
         return Formatting::errorIcon();
     }
     return iconForValidityAndCompliance(minimalValidity(group.keys()), allKeysAreCompliant(group.keys()));
 }
 
 bool Formatting::uidsHaveFullValidity(const Key &key)
 {
     return allUserIDsHaveFullValidity(key);
 }
 
 QString Formatting::complianceMode()
 {
     const auto complianceValue = getCryptoConfigStringValue("gpg", "compliance");
     return complianceValue == QLatin1StringView("gnupg") ? QString() : complianceValue;
 }
 
 bool Formatting::isKeyDeVs(const GpgME::Key &key)
 {
     return DeVSCompliance::allSubkeysAreCompliant(key);
 }
 
 QString Formatting::complianceStringForKey(const GpgME::Key &key)
 {
     // There will likely be more in the future for other institutions
     // for now we only have DE-VS
     if (DeVSCompliance::isCompliant()) {
         return isRemoteKey(key) //
             ? i18nc("@info the compliance of the key with certain requirements is unknown", "unknown")
             : DeVSCompliance::name(DeVSCompliance::keyIsCompliant(key));
     }
     return QString();
 }
 
 QString Formatting::complianceStringForUserID(const GpgME::UserID &userID)
 {
     // There will likely be more in the future for other institutions
     // for now we only have DE-VS
     if (DeVSCompliance::isCompliant()) {
         return isRemoteKey(userID.parent()) //
             ? i18nc("@info the compliance of the key with certain requirements is unknown", "unknown")
             : DeVSCompliance::name(DeVSCompliance::userIDIsCompliant(userID));
     }
     return QString();
 }
 
 QString Formatting::complianceStringShort(const GpgME::UserID &id)
 {
     if (DeVSCompliance::isCompliant() && DeVSCompliance::userIDIsCompliant(id)) {
         return QStringLiteral("★ ") + DeVSCompliance::name(true);
     }
     const bool keyValidityChecked = (id.parent().keyListMode() & GpgME::Validate);
     if (keyValidityChecked && id.validity() >= UserID::Full) {
         return i18nc("As in 'this user ID is valid.'", "certified");
     }
     if (id.parent().isExpired() || isExpired(id)) {
         return i18n("expired");
     }
     if (id.parent().isRevoked() || id.isRevoked()) {
         return i18n("revoked");
     }
     if (id.parent().isDisabled()) {
         return i18n("disabled");
     }
     if (id.parent().isInvalid() || id.isInvalid()) {
         return i18n("invalid");
     }
     if (keyValidityChecked) {
         return i18nc("As in 'this user ID is not certified'", "not certified");
     }
 
     return i18nc("The validity of this user ID has not been/could not be checked", "not checked");
 }
 
 QString Formatting::complianceStringShort(const GpgME::Key &key)
 {
     if (DeVSCompliance::isCompliant() && DeVSCompliance::keyIsCompliant(key)) {
         return QStringLiteral("★ ") + DeVSCompliance::name(true);
     }
     const bool keyValidityChecked = (key.keyListMode() & GpgME::Validate);
     if (keyValidityChecked && Kleo::allUserIDsHaveFullValidity(key)) {
         return i18nc("As in all user IDs are valid.", "certified");
     }
     if (key.isExpired()) {
         return i18n("expired");
     }
     if (key.isRevoked()) {
         return i18n("revoked");
     }
     if (key.isDisabled()) {
         return i18n("disabled");
     }
     if (key.isInvalid()) {
         return i18n("invalid");
     }
     if (keyValidityChecked) {
         return i18nc("As in not all user IDs are valid.", "not certified");
     }
 
     return i18nc("The validity of the user IDs has not been/could not be checked", "not checked");
 }
 
 QString Formatting::complianceStringShort(const KeyGroup &group)
 {
     const KeyGroup::Keys &keys = group.keys();
 
     const bool allKeysFullyValid = std::all_of(keys.cbegin(), keys.cend(), &Kleo::allUserIDsHaveFullValidity);
     if (allKeysFullyValid) {
         return i18nc("As in all keys are valid.", "all certified");
     }
 
     return i18nc("As in not all keys are valid.", "not all certified");
 }
 
 QString Formatting::prettyID(const char *id)
 {
     if (!id) {
         return QString();
     }
     QString ret = QString::fromLatin1(id).toUpper().replace(QRegularExpression(QStringLiteral("(....)")), QStringLiteral("\\1 ")).trimmed();
     // For the standard 10 group fingerprint let us use a double space in the
     // middle to increase readability
     if (ret.size() == 49) {
         ret.insert(24, QLatin1Char(' '));
     }
     return ret;
 }
 
 QString Formatting::accessibleHexID(const char *id)
 {
     static const QRegularExpression groupOfFourRegExp{QStringLiteral("(?:(.)(.)(.)(.))")};
 
     QString ret;
     ret = QString::fromLatin1(id);
     if (!ret.isEmpty() && (ret.size() % 4 == 0)) {
         ret = ret.replace(groupOfFourRegExp, QStringLiteral("\\1 \\2 \\3 \\4, ")).chopped(2);
     }
     return ret;
 }
 
 QString Formatting::origin(int o)
 {
     switch (o) {
     case Key::OriginKS:
         return i18n("Keyserver");
     case Key::OriginDane:
         return QStringLiteral("DANE");
     case Key::OriginWKD:
         return QStringLiteral("WKD");
     case Key::OriginURL:
         return QStringLiteral("URL");
     case Key::OriginFile:
         return i18n("File import");
     case Key::OriginSelf:
         return i18n("Generated");
     case Key::OriginOther:
     case Key::OriginUnknown:
     default:
         return i18n("Unknown");
     }
 }
 
 QString Formatting::deVsString(bool compliant)
 {
     return DeVSCompliance::name(compliant);
 }
 
 namespace
 {
 QString formatTrustScope(const char *trustScope)
 {
     static const QRegularExpression escapedNonAlphaNum{QStringLiteral(R"(\\([^0-9A-Za-z]))")};
 
     const auto scopeRegExp = QString::fromUtf8(trustScope);
     if (scopeRegExp.startsWith(u"<[^>]+[@.]") && scopeRegExp.endsWith(u">$")) {
         // looks like a trust scope regular expression created by gpg
         auto domain = scopeRegExp.mid(10, scopeRegExp.size() - 10 - 2);
         domain.replace(escapedNonAlphaNum, QStringLiteral(R"(\1)"));
         return domain;
     }
     return scopeRegExp;
 }
 }
 
 QString Formatting::trustSignatureDomain(const GpgME::UserID::Signature &sig)
 {
     return formatTrustScope(sig.trustScope());
 }
 
 QString Formatting::trustSignature(const GpgME::UserID::Signature &sig)
 {
     switch (sig.trustValue()) {
     case TrustSignatureTrust::Partial:
         return i18nc("Certifies this key as partially trusted introducer for 'domain name'.",
                      "Certifies this key as partially trusted introducer for '%1'.",
                      trustSignatureDomain(sig));
     case TrustSignatureTrust::Complete:
         return i18nc("Certifies this key as fully trusted introducer for 'domain name'.",
                      "Certifies this key as fully trusted introducer for '%1'.",
                      trustSignatureDomain(sig));
     default:
         return {};
     }
 }
 
 QString Formatting::errorAsString(const GpgME::Error &error)
 {
 #ifdef Q_OS_WIN
     // On Windows, we set GpgME resp. libgpg-error to return (translated) error messages as UTF-8
     const char *s = error.asString();
     qCDebug(LIBKLEO_LOG) << __func__ << "gettext_use_utf8(-1) returns" << gettext_use_utf8(-1);
     qCDebug(LIBKLEO_LOG) << __func__ << "error:" << s;
     qCDebug(LIBKLEO_LOG) << __func__ << "error (percent-encoded):" << QByteArray{s}.toPercentEncoding();
     return QString::fromUtf8(s);
 #else
     return QString::fromLocal8Bit(error.asString());
 #endif
 }
 
 QString Formatting::prettyAlgorithmName(const std::string &algorithm)
 {
     static const std::map<std::string, QString> displayNames = {
         {"brainpoolP256r1", i18nc("@info", "ECC (Brainpool P-256)")},
         {"brainpoolP384r1", i18nc("@info", "ECC (Brainpool P-384)")},
         {"brainpoolP512r1", i18nc("@info", "ECC (Brainpool P-512)")},
         {"curve25519", i18nc("@info", "ECC (Curve25519)")},
         {"curve448", i18nc("@info", "ECC (Curve448)")},
         {"ed25519", i18nc("@info", "ECC (Ed25519)")},
         {"ed448", i18nc("@info", "ECC (Ed448)")},
         {"cv25519", i18nc("@info", "ECC (Cv25519)")},
         {"cv448", i18nc("@info", "ECC (Cv448)")},
         {"nistp256", i18nc("@info", "ECC (NIST P-256)")},
         {"nistp384", i18nc("@info", "ECC (NIST P-384)")},
         {"nistp521", i18nc("@info", "ECC (NIST P-521)")},
         {"rsa2048", i18nc("@info", "RSA 2048")},
         {"rsa3072", i18nc("@info", "RSA 3072")},
         {"rsa4096", i18nc("@info", "RSA 4096")},
         {"dsa1024", i18nc("@info", "DSA 1024")},
         {"dsa2048", i18nc("@info", "DSA 2048")},
         {"elg1024", i18nc("@info", "Elgamal 1024")},
         {"elg2048", i18nc("@info", "Elgamal 2048")},
         {"elg3072", i18nc("@info", "Elgamal 3072")},
         {"elg4096", i18nc("@info", "Elgamal 4096")},
     };
     const auto it = displayNames.find(algorithm);
     return (it != displayNames.end()) ? it->second : i18nc("@info", "Unknown algorithm");
 }