Signature Verification in OpenPGP is hard. Here is why.