Verify that GnuPG does not leak timezone in email signatures

Originally created by @geb on #7103 (Redmine)

Hi,

TorBirdy design doc [1] is a mentions potential timezone leak by thunderbird. Otherwise there is no information about potential timezone leak by GPG. GPG includes time when it is used to sign content.

The PGP RFC [2] tell that time fields should be in UTC. In my tests, GPG and enigmail print the date in local format. So it would be interesting to verify if they fully respect RFC and send messages with date in UTC.

[1] https://trac.torproject.org/projects/tor/raw-attachment/wiki/doc/TorifyHOWTO/EMail/Thunderbird/Thunderbird%2BTor.pdf
[2] https://tools.ietf.org/html/rfc4880#section-3.5

Parent Task: #5663 (closed)

Related issues

• Related to #6284 (closed)