sm: Don't mark a cert as de-vs compliant if it leads to SHA-1 sigs.

sm: Don't mark a cert as de-vs compliant if it leads to SHA-1 sigs.

* sm/keylist.c (print_compliance_flags): Also check the digest_algo.
Add new arg 'cert'.
--

A certificate with algorithm sha1WithRSAEncryption can be de-vs
compliant (e.g. if the next in the chain used sha256WithRSAEncryption
to sign it and RSA is long enough) but flagging it as such is useless
because that certificate can't be used because it will create
signatures using the non-compliant SHA-1 algorithm.

Well, it could be used for encryption.  But also evaluating the
key-usage flags here would make it harder for the user to understand
why certain certificates are listed as de-vs compliant and others are
not.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 2c75af9f65d15653ed1bc191f1098ae316607041)

Reworked to also pass the CERT.  Note that 2.2 won't get the PK
Screening feature.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit be69bf0cbd11cb8c0d452e07066669aacc6caafa)

Gbp-Pq: Topic from-2.2.14
Gbp-Pq: Name sm-Don-t-mark-a-cert-as-de-vs-compliant-if-it-leads-to-SH.patch