diff --git a/HOpenPGP/Tools/Common/TKUtils.hs b/HOpenPGP/Tools/Common/TKUtils.hs
--- a/HOpenPGP/Tools/Common/TKUtils.hs
+++ b/HOpenPGP/Tools/Common/TKUtils.hs
@@ -24,6 +24,9 @@
     ( eightOctetKeyID
     , fingerprint
     )
+import Codec.Encryption.OpenPGP.Policy
+    ( defaultVerificationPolicy
+    )
 import Codec.Encryption.OpenPGP.Signatures
     ( verifyAgainstKeys
     , verifySigWith
@@ -45,7 +48,7 @@
 processTK mpt tk =
     first show
         $ verifyUnknownTKWith
-            (verifySigWith (verifyAgainstKeys [tk]))
+            (verifySigWith defaultVerificationPolicy (verifyAgainstKeys [tk]))
             (fmap posixSecondsToUTCTime mpt)
             . stripOlderSigs
             . stripOtherSigs
diff --git a/HOpenPGP/Tools/Hokey/InjectSSHAgent.hs b/HOpenPGP/Tools/Hokey/InjectSSHAgent.hs
--- a/HOpenPGP/Tools/Hokey/InjectSSHAgent.hs
+++ b/HOpenPGP/Tools/Hokey/InjectSSHAgent.hs
@@ -261,7 +261,7 @@
             Right $
                 frameSSHAgentRequest
                     (rsaAddIdentityPayload (BC8.pack comment) rsaPrivateKey)
-        SUUnencrypted (EdDSAPrivateKey Ed25519 secretSeed) _ ->
+        SUUnencrypted (EdDSAPrivateKey EdSigningCurve25519 secretSeed) _ ->
             frameSSHAgentRequest
                 <$> ed25519AddIdentityPayload (BC8.pack comment) subkeyPKP secretSeed
         SUUnencrypted (UnknownSKey rawSecret) _
@@ -271,7 +271,7 @@
                         (BC8.pack comment)
                         subkeyPKP
                         (BL.toStrict rawSecret)
-        SUUnencrypted (EdDSAPrivateKey Ed448 _) _ ->
+        SUUnencrypted (EdDSAPrivateKey EdSigningCurve448 _) _ ->
             Left
                 ( "subkey "
                     ++ renderFingerprint (fingerprint subkeyPKP)
@@ -329,7 +329,7 @@
 ed25519PublicPoint :: SomePKPayload -> Either String B.ByteString
 ed25519PublicPoint pkp =
     case _pubkey pkp of
-        EdDSAPubKey Ed25519 point ->
+        EdDSAPubKey EdSigningCurve25519 point ->
             maybe
                 ( Left
                     ( "invalid Ed25519 public point for subkey "
diff --git a/hkt.hs b/hkt.hs
--- a/hkt.hs
+++ b/hkt.hs
@@ -29,6 +29,9 @@
     ( parseEightOctetKeyId
     , parseFingerprint
     )
+import Codec.Encryption.OpenPGP.Policy
+    ( defaultVerificationPolicy
+    )
 import Codec.Encryption.OpenPGP.Serialize ()
 import Codec.Encryption.OpenPGP.Signatures
     ( verifyAgainstKeyring
@@ -541,7 +544,7 @@
                     ( rights
                         ( map
                             ( verifyUnknownTKWith
-                                (verifySigWith (verifyAgainstKeyring kr))
+                                (verifySigWith defaultVerificationPolicy (verifyAgainstKeyring kr))
                                 (Just (posixSecondsToUTCTime cpt))
                             )
                             keys
@@ -672,7 +675,7 @@
                 ( rights
                     ( map
                         ( verifyUnknownTKWith
-                            (verifySigWith (verifyAgainstKeyring kr))
+                            (verifySigWith defaultVerificationPolicy (verifyAgainstKeyring kr))
                             (Just (posixSecondsToUTCTime cpt))
                         )
                         keys
diff --git a/hop.hs b/hop.hs
--- a/hop.hs
+++ b/hop.hs
@@ -67,6 +67,7 @@
 import Codec.Encryption.OpenPGP.Policy
     ( defaultDecryptPolicy
     , defaultPolicy
+    , defaultVerificationPolicy
     , lenientDecryptPolicy
     )
 import Codec.Encryption.OpenPGP.S2K
@@ -1224,9 +1225,12 @@
                 ts
                 0
                 (toFVal 27)
-                (EdDSAPubKey Ed25519 (NativeEPoint (EPoint (os2ip pubBytes))))
+                ( EdDSAPubKey
+                    EdSigningCurve25519
+                    (NativeEPoint (EPoint (os2ip pubBytes)))
+                )
             )
-            (SUUnencrypted (EdDSAPrivateKey Ed25519 privBytes) 0)
+            (SUUnencrypted (EdDSAPrivateKey EdSigningCurve25519 privBytes) 0)
 generateSecretKey ts keyVersion GeneratedX25519Key = do
     priv <- Curve25519.generateSecretKey
     let pub = Curve25519.toPublic priv
@@ -1239,7 +1243,10 @@
                 ts
                 0
                 X25519
-                (EdDSAPubKey Ed25519 (NativeEPoint (EPoint (os2ip pubBytes))))
+                ( EdDSAPubKey
+                    EdSigningCurve25519
+                    (NativeEPoint (EPoint (os2ip pubBytes)))
+                )
             )
             (SUUnencrypted (X25519PrivateKey privBytes) 0)
 
@@ -1824,7 +1831,10 @@
         Left _ -> False
         Right verifiedTk -> any matchingBoundUid (_tkuUIDs verifiedTk)
   where
-    verifier = verifySigWith (verifyAgainstKeys (certTk : authorityTks))
+    verifier =
+        verifySigWith
+            defaultVerificationPolicy
+            (verifyAgainstKeys (certTk : authorityTks))
     matchingBoundUid (uid, sigs) =
         useridMatches addrSpecOnly targetUserId uid
             && any (signatureMatchesSigner certTk) sigs
@@ -2669,7 +2679,8 @@
                         signWithRSABuilder
                             signHash
                             (k {RSA.private_p = 0, RSA.private_q = 0})
-        Just (SUUnencrypted (EdDSAPrivateKey Ed25519 rawBytes) _) ->
+        Just
+            (SUUnencrypted (EdDSAPrivateKey EdSigningCurve25519 rawBytes) _) ->
             case eitherCryptoError (Ed25519.secretKey rawBytes) of
                 Left err ->
                     failWith
@@ -2685,7 +2696,8 @@
                         case signDataWithEd25519 st sk hsd usd payload of
                             Left err' -> failWith BadData (ctx ++ " failed: " ++ renderSignError err')
                             Right sig -> pure sig
-        Just (SUUnencrypted (EdDSAPrivateKey Ed448 rawBytes) _) ->
+        Just
+            (SUUnencrypted (EdDSAPrivateKey EdSigningCurve448 rawBytes) _) ->
             case eitherCryptoError (Ed448.secretKey rawBytes) of
                 Left err ->
                     failWith
@@ -3845,7 +3857,7 @@
 
     normalizeX25519CompatibleECDHRecipient pkp =
         case _pubkey pkp of
-            ECDHPubKey (EdDSAPubKey Ed25519 _) _ _ ->
+            ECDHPubKey (EdDSAPubKey EdSigningCurve25519 _) _ _ ->
                 Just
                     ( PKPayload
                         (_keyVersion pkp)
@@ -5547,7 +5559,7 @@
     :: SomePKPayload -> Maybe SomePKPayload
 normalizeX25519CompatiblePKP pkp =
     case _pubkey pkp of
-        ECDHPubKey (EdDSAPubKey Ed25519 _) _ _ ->
+        ECDHPubKey (EdDSAPubKey EdSigningCurve25519 _) _ _ ->
             Just
                 ( PKPayload
                     (_keyVersion pkp)
diff --git a/hopenpgp-tools.cabal b/hopenpgp-tools.cabal
--- a/hopenpgp-tools.cabal
+++ b/hopenpgp-tools.cabal
@@ -1,6 +1,6 @@
 cabal-version:       3.0
 name:                hopenpgp-tools
-version:             0.25.2
+version:             0.25.3
 synopsis:            hOpenPGP-based command-line tools
 description:         command-line tools for performing some OpenPGP-related operations
 homepage:            https://salsa.debian.org/clint/hOpenPGP-tools
@@ -25,7 +25,7 @@
                ,       bytestring
                ,       conduit                >= 1.3
                ,       errors
-               ,       hOpenPGP               >= 3.0.2      && < 3.1
+               ,       hOpenPGP               >= 3.1        && < 3.2
                ,       lens
                ,       optparse-applicative   >= 0.18.1
                ,       prettyprinter          >= 1.7
@@ -129,4 +129,4 @@
 source-repository this
   type:     git
   location: https://salsa.debian.org/clint/hopenpgp-tools.git
-  tag:      hopenpgp-tools/0.25.2
+  tag:      hopenpgp-tools/0.25.3