PGPainless key parameter validation is not enabled after migration to 2.x

[DenBond7]

After migrating PGPainless from 1.7.6 to 2.x, key parameter validation is no longer enabled correctly during application initialization.

The current implementation in FlowCryptApplication.kt is:

PGPainless.setInstance(
 PGPainless(algorithmPolicy = generatePGPainlessPolicy().apply {
 PGPainless.getInstance().algorithmPolicy.enableKeyParameterValidation = true
 })
)

The receiver of apply is the newly generated policy. However, the code does not modify that receiver. Instead, it modifies the policy belonging to the current global PGPainless instance.

The sequence is therefore:

1. generatePGPainlessPolicy() builds a new policy with key parameter validation disabled.
2. The policy of the old global PGPainless instance is updated.
3. A new PGPainless instance is installed using the previously generated policy.
4. The old instance and its updated policy are discarded.

As a result:

PGPainless.getInstance()
 .algorithmPolicy
 .enableKeyParameterValidation

remains false after application initialization.

Expected behavior

Key parameter validation should be enabled for the policy installed in the new global PGPainless instance.

Impact

This is a regression of the protection introduced for issue #2111. Malformed or corrupted key material may not receive the expected parameter validation.

The existing testReadCorruptedPrivateKey() test does not detect this configuration problem because it enables the option manually before performing the test.

Proposed fix

Configure the newly generated policy directly:

private fun setupPGPainless() {
 PGPainless.setInstance(
 PGPainless(
 algorithmPolicy = generatePGPainlessPolicy().apply {
 enableKeyParameterValidation = true
 }
 )
 )
}

Acceptance criteria

• The installed global PGPainless policy has enableKeyParameterValidation == true.
• A regression test verifies the configuration produced during application initialization.
• The corrupted-private-key test passes without enabling key parameter validation manually inside the test.