Drop v3 keys by default when cleaning keys

[onak.git] / onak.ini.in

diff --git a/onak.ini.in b/onak.ini.in
index 4dbf8305d516cf73fbf7a7447ac02efa96148c56..8989f0704a28832ed4685c8671b562bf1fd32c98 100644 (file)
--- a/onak.ini.in
+++ b/onak.ini.in
@@ -19,6 +19,9 @@ max_reply_keys=128
 ; Verify signature hashes - verify that the hash a signature claims to be
 ; over matches the hash of the data. Does not actually verify the signature.
 check_sighash=true
+; Drop v3 (and older) keys. These are long considered insecure, so unless there
+; is a good reason you should accept this default.
+drop_v3=true
 
 ; Settings related to the email interface to onak.
 [mail]