--run-quorum's --keyring with --shardfile to use shardfile certs for verifying
keyfork recover --daemon
idna from sequoia-openpgp
Keyfork can't export the entropy it was started with. You'll want to instead do:
sq decrypt --recipient-file secret_key < encrypted.asc --output decrypted
sq encrypt --for-file cert.asc <secret_file> --output encrypted.asc. no need to import in gpg.
I think in this case it would be reasonable for us to extend the generate-shard-secret wizard, since generating keys is out of scope for keyfork mnemonic generate, and is only used for…
they would need to do the old flow of recover the mnemonic, derive the key, and extract the certificate. mnemonic generate is for the sole purpose of generating a mnemonic and creating backups of that mnemonic, not for generating storage encryption keys of the mnemonic. the fact --encrypt-to-self does so is a requirement of GnuPG and is considered a hack.