Comment 1:

http://golang.org/cl/5627045
http://golang.org/cl/5629044
Reset(): Since the garbage collector can copy memory around at will, and it can be
swapped out etc, I fear that Reset() is promising something that we can't deliver and so
should be removed.
The various errors in RSA might be a little vague (and need the package name at the
beginning of the error), but I've tried to follow the idea that distinct errors are
useful when code might want to behave differently based on that error. So
VerificationError means that the signature is bust, which might be useful to distinguish
from "I/O error from the random source" and "we don't support this hash function", which
are other errors that can come from signature verification.
I don't care much either way however if you want to flatten them.
SetWriteDeadline seemed like a longer change so I left that for a different CL.

Comment 2:

Thanks.
Removing Reset sounds fine; then we can still make the cipher
implementations return cipher.Block.
Regarding the errors, my suggestion is that instead of
// A VerificationError represents a failure to verify a signature.
// It is deliberately vague to avoid adaptive attacks.
type VerificationError struct{}
func (VerificationError) Error() string { return "RSA verification error" }
which people have to check for iwth
    if _, ok := err.(rsa.VerificationError); ok {
you can now write
// ErrVerification represents a failure to verify a signature.
// It is deliberately vague to avoid adaptive attacks.
var ErrVerification = errors.New("RSA verification error")
and people can check for it with
    if err == rsa.ErrVerification {

Comment 3:

I hope this is the appropriate place to add/report this.
The error returned after attempting to serialize an unsigned public key could be more
accurate/accurate. The error text is "Signature: need to call SignRSA or SignDSA before
Serialize", but "SignRSA" and "SignDSA" do not exist anywhere else in the source tree.
They appear to have been rolled into (*Signature).Sign. So error and godoc comment
should probably be changed to reflect this: error "Signature: need to call Sign, SignKey
or SignUserId before Serialize", comment "Sign, SignKey or SignUserId must have been
called first. "
Should openpgp/errors.unknownIssuerError return "signature made by unknown entity"
rather than "signature make by unknown entity"?

Comment 4:

dan.kortschak: thanks for the report. Will fix once a pending CL for the same files is
submitted.

Owner changed to @agl.

Comment 5:

The recent commit
http://code.google.com/p/go/source/detail?r=9d7addec2635c403f33a3344444fbaa813ed81d1
seems to have removed a number of updates to go1.tmpl and go1.html, probably
unintentionally.

Comment 6:

dgryski: thank you for that. hg continually finds new ways to disappoint. Fixed in
604b19afea4b

Comment 7:

This issue was closed by revision golang/crypto@63736bd.

Status changed to Fixed.