1.1 --- a/src/pgp_sequoia.c	Wed Mar 20 15:31:43 2019 +0100
     1.2 +++ b/src/pgp_sequoia.c	Wed Mar 20 17:40:18 2019 +0100
     1.3 @@ -663,7 +663,9 @@
     1.4  
     1.5      // Insert the "subkeys" (the primary key and the subkeys).
     1.6      stmt = session->sq_sql.tpk_save_insert_subkeys;
     1.7 -    key_iter = pgp_tpk_key_iter(tpk);
     1.8 +    // This inserts all of the keys in the TPK, i.e., revoked and
     1.9 +    // expired keys, which is what we want.
    1.10 +    key_iter = pgp_tpk_key_iter_all(tpk);
    1.11      pgp_key_t key;
    1.12      while ((key = pgp_tpk_key_iter_next(key_iter, NULL, NULL))) {
    1.13          pgp_keyid_t keyid = pgp_key_keyid(key);
    1.14 @@ -868,7 +870,7 @@
    1.15          if (! is_tsk)
    1.16              goto eol;
    1.17  
    1.18 -        key_iter = pgp_tpk_key_iter(tpk);
    1.19 +        key_iter = pgp_tpk_key_iter_all(tpk);
    1.20          pgp_key_t key;
    1.21          while ((key = pgp_tpk_key_iter_next(key_iter, NULL, NULL))) {
    1.22              pgp_keyid_t this_keyid = pgp_key_keyid(key);
    1.23 @@ -929,7 +931,7 @@
    1.24          for (int j = 0; j < tsks_count; j ++) {
    1.25              pgp_tpk_t tsk = tsks[j];
    1.26  
    1.27 -            key_iter = pgp_tpk_key_iter(tsk);
    1.28 +            key_iter = pgp_tpk_key_iter_all(tsk);
    1.29              pgp_key_t key;
    1.30              pgp_signature_t selfsig;
    1.31              while ((key = pgp_tpk_key_iter_next(key_iter, &selfsig, NULL))) {
    1.32 @@ -1872,7 +1874,7 @@
    1.33      }
    1.34  
    1.35      PEP_comm_type best_enc = PEP_ct_no_encryption, best_sign = PEP_ct_no_encryption;
    1.36 -    pgp_tpk_key_iter_t key_iter = pgp_tpk_key_iter(tpk);
    1.37 +    pgp_tpk_key_iter_t key_iter = pgp_tpk_key_iter_valid(tpk);
    1.38      pgp_key_t key;
    1.39      pgp_signature_t sig;
    1.40      pgp_revocation_status_t rev;
    1.41 @@ -2036,7 +2038,7 @@
    1.42      // and one encryption subkey that are live?
    1.43      int can_certify = 0, can_encrypt = 0, can_sign = 0;
    1.44  
    1.45 -    pgp_tpk_key_iter_t key_iter = pgp_tpk_key_iter(tpk);
    1.46 +    pgp_tpk_key_iter_t key_iter = pgp_tpk_key_iter_valid(tpk);
    1.47      pgp_key_t key;
    1.48      pgp_signature_t sig;
    1.49      pgp_revocation_status_t rev;