diff --git a/HOpenPGP/Tools/Common/TKUtils.hs b/HOpenPGP/Tools/Common/TKUtils.hs
--- a/HOpenPGP/Tools/Common/TKUtils.hs
+++ b/HOpenPGP/Tools/Common/TKUtils.hs
@@ -65,7 +65,7 @@
     vsf =
         verifySigWith
             policy
-            (verifyAgainstKeys (map someTKToUnknown keyring))
+            (verifyAgainstKeys (map someTKToPublicViewTK keyring))
 
 processTK
     :: Maybe POSIXTime -> SomeTK -> Either String SomeTK
diff --git a/HOpenPGP/Tools/Hokey/Lint.hs b/HOpenPGP/Tools/Hokey/Lint.hs
--- a/HOpenPGP/Tools/Hokey/Lint.hs
+++ b/HOpenPGP/Tools/Hokey/Lint.hs
@@ -19,6 +19,7 @@
 {-# LANGUAGE DeriveGeneric #-}
 {-# LANGUAGE FlexibleInstances #-}
 {-# LANGUAGE LambdaCase #-}
+{-# LANGUAGE MonoLocalBinds #-}
 {-# LANGUAGE RecordWildCards #-}
 {-# LANGUAGE TypeApplications #-}
 
diff --git a/hop.hs b/hop.hs
--- a/hop.hs
+++ b/hop.hs
@@ -59,7 +59,6 @@
     , encryptMessage
     , encryptedPayloadBytes
     , mkClearPayload
-    , mkPassphrase
     )
 import Codec.Encryption.OpenPGP.Ontology
     ( isKUF
@@ -79,7 +78,7 @@
     )
 import Codec.Encryption.OpenPGP.SecretKey
     ( decryptPrivateKey
-    , encryptPrivateKey
+    , encryptSecretKeyWithPolicy
     )
 import Codec.Encryption.OpenPGP.Serialize (parsePkts)
 import Codec.Encryption.OpenPGP.Signatures
@@ -1566,17 +1565,23 @@
     encryptSub other = pure other
     encryptSecretAddendumForOutput pkp ska =
         case ska of
-            SUUnencrypted {} -> doEncryptSecret
+            SUUnencrypted skey _ -> doEncryptSecret skey
             _ -> pure ska
       where
-        doEncryptSecret = do
+        doEncryptSecret skey = do
             encryptedResult <-
-                encryptPrivateKey defaultPolicy pkp ska password
+                encryptSecretKeyWithPolicy
+                    defaultPolicy
+                    pkp
+                    skey
+                    (Passphrase password)
             case encryptedResult of
                 Left err ->
                     failWith
                         BadData
-                        ("generate-key: failed to protect secret key material: " ++ err)
+                        ( "generate-key: failed to protect secret key material: "
+                            ++ show err
+                        )
                 Right val -> pure val
 
 rsaSigningKey :: SKAddendum -> IO RSA.PrivateKey
@@ -3149,7 +3154,7 @@
             []
             ( effectiveKeyPreferencesAt
                 (posixSecondsToUTCTime (realToFrac pt))
-                (someTKToUnknown tk)
+                (someTKToPublicViewTK tk)
             )
   where
     toHashes (PreferredHashAlgorithms hashes) = hashes
@@ -3163,7 +3168,7 @@
             []
             ( effectiveKeyPreferencesAt
                 (posixSecondsToUTCTime (realToFrac pt))
-                (someTKToUnknown tk)
+                (someTKToPublicViewTK tk)
             )
   where
     toSymmetricAlgorithms (PreferredSymmetricAlgorithms algorithms) = algorithms
@@ -3177,7 +3182,7 @@
                 []
                 ( effectiveKeyPreferencesAt
                     (posixSecondsToUTCTime (realToFrac pt))
-                    (someTKToUnknown tk)
+                    (someTKToPublicViewTK tk)
                 )
   where
     toFeatureFlags (Features flags) = S.toList flags
@@ -3766,7 +3771,7 @@
                             , rfc9580EncryptMessageS2K = Argon2 s2kSalt 1 4 15
                             , rfc9580EncryptMessageIV = iv
                             }
-                        (mkPassphrase password)
+                        (Passphrase password)
                         (mkClearPayload payload)
             EncryptProfileRFC4880 -> do
                 salt <- Salt8 <$> getRandomBytes 8
@@ -3779,7 +3784,7 @@
                             , rfc4880EncryptMessageS2K = IteratedSalted SHA256 salt 65536
                             , rfc4880EncryptMessageIV = iv
                             }
-                        (mkPassphrase password)
+                        (Passphrase password)
                         (mkClearPayload payload)
     case encrypted of
         Left err -> failWith BadData ("encrypt failed: " ++ show err)
@@ -5380,7 +5385,7 @@
                 if not
                     ( isTKTimeValid
                         (posixSecondsToUTCTime (realToFrac cpt))
-                        (someTKToUnknown normalized)
+                        (someTKToPublicViewTK normalized)
                     )
                     then
                         failWith
diff --git a/hopenpgp-tools.cabal b/hopenpgp-tools.cabal
--- a/hopenpgp-tools.cabal
+++ b/hopenpgp-tools.cabal
@@ -1,6 +1,6 @@
 cabal-version:       3.0
 name:                hopenpgp-tools
-version:             0.25.3.2
+version:             0.25.4
 synopsis:            hOpenPGP-based command-line tools
 description:         command-line tools for performing some OpenPGP-related operations
 homepage:            https://salsa.debian.org/clint/hOpenPGP-tools
@@ -25,7 +25,7 @@
                ,       bytestring
                ,       conduit                >= 1.3
                ,       errors
-               ,       hOpenPGP               >= 3.1.1      && < 3.2
+               ,       hOpenPGP               >= 3.2        && < 3.3
                ,       lens
                ,       optparse-applicative   >= 0.18.1
                ,       prettyprinter          >= 1.7
@@ -130,4 +130,4 @@
 source-repository this
   type:     git
   location: https://salsa.debian.org/clint/hopenpgp-tools.git
-  tag:      hopenpgp-tools/0.25.3.2
+  tag:      hopenpgp-tools/0.25.4