When you sign a (public key, user ID) couple using a V3 RSA key, gnupg will create a V3 signature. This includes the case of local signatures. Bad enough, there is no such concept as a local V3 signature, which implies that using “lsign” with a V3 RSA key is equivalent to “sign”, and produces an exportable(!) signature.
This, in turn, can lead to considerable embarrassment (and loss of reputation) of the signer, and to bad judgement by others who rely on such signatures.
This patch fixes this problem by adding a minimum version parameter to make_keysig_packet(), and makes sure that local signatures are always at least V4.
No Such Weblog 