@cybertailor Or well, the only way it works is to handle the keys like if they would be pure rsa/ed25519 ones where you explicitly tell which key is valid for a given signature without all the rest (like gentoo does).
At that point you might as well just use signify.