The gpg.fail page mentions minisign vulns too.