gpg now --trust-model=always like seahorse; openssl now uses -md sha256