On Fri, Oct 11, 2013 at 9:55 AM, Konstantin Ryabitsev
> Or does the check fail only if the key had already expired when
> signature was made?
Looks like gpg verify doesn't take that into consideration.
PS: And, FYI, for a very good reason -- it is very simple for an
attacker to change the date on their system before signing a tarball,
to make it look like the signature was made while the key was still
valid and thus satisfy the checks.