openpgp: Use the new framework for Cert::userid.

  - Fixes #414.

18 files changed, 82 insertions, 131 deletions

diff --git a/examples/guide-exploring-openpgp.rs b/examples/guide-exploring-openpgp.rs
index 004c9899..31c6aa61 100644
--- a/examples/guide-exploring-openpgp.rs
+++ b/examples/guide-exploring-openpgp.rs
@@ -52,11 +52,11 @@ fn main() {
     println!("Fingerprint: {}", cert.fingerprint());
 
     // List userids.
-    for (i, u) in cert.userids().enumerate() {
+    for (i, ca) in cert.userids().policy(None).enumerate() {
         println!("{}: UID: {}, {} self-signature(s), {} certification(s)",
-                 i, u.userid(),
-                 u.self_signatures().len(),
-                 u.certifications().len());
+                 i, ca.userid(),
+                 ca.component().self_signatures().len(),
+                 ca.component().certifications().len());
     }
 
     // List subkeys.
diff --git a/guide/src/chapter_03.md b/guide/src/chapter_03.md
index 70f8676b..91f07b04 100644
--- a/guide/src/chapter_03.md
+++ b/guide/src/chapter_03.md
@@ -48,8 +48,7 @@ fn main() {
 
     // Iterate over UserIDs.
     assert_eq!(cert.userids().count(), 1);
-    assert_eq!(cert.userids().nth(0).unwrap().userid(),
-               &"Ἀριστοτέλης".into());
+    assert_eq!(cert.userids().nth(0).unwrap().to_string(), "Ἀριστοτέλης");
 
     // Iterate over subkeys.
     assert_eq!(cert.keys().subkeys().count(), 2);
diff --git a/net/src/wkd.rs b/net/src/wkd.rs
index 663e0d57..967635d8 100644
--- a/net/src/wkd.rs
+++ b/net/src/wkd.rs
@@ -235,7 +235,7 @@ fn parse_body<S: AsRef<str>>(body: &[u8], email_address: S)
     let valid_certs: Vec<Cert> = certs.iter()
         // XXX: This filter could become a Cert method, but it adds other API
         // method to maintain
-        .filter(|cert| {cert.userids()
+        .filter(|cert| {cert.userids().components()
             .any(|uidb|
                 if let Ok(Some(a)) = uidb.userid().email() {
                     a == email_address
@@ -344,7 +344,7 @@ pub fn insert<P, S, V>(base_path: P, domain: S, variant: V,
     let variant = variant.into().unwrap_or_default();
 
     // First, check which UserIDs are in `domain`.
-    let addresses = cert.userids().filter_map(|uidb| {
+    let addresses = cert.userids().components().filter_map(|uidb| {
         uidb.userid().email().unwrap_or(None).and_then(|addr| {
             if EmailAddress::from(&addr).ok().map(|e| e.domain == domain)
                 .unwrap_or(false)
diff --git a/openpgp-ffi/src/cert.rs b/openpgp-ffi/src/cert.rs
index b9cdb93e..1b4bc65d 100644
--- a/openpgp-ffi/src/cert.rs
+++ b/openpgp-ffi/src/cert.rs
@@ -362,7 +362,7 @@ fn pgp_cert_primary_user_id(cert: *const Cert)
                            -> *mut c_char
 {
     let cert = cert.ref_raw();
-    if let Some(binding) = cert.userids().nth(0) {
+    if let Some(binding) = cert.userids().primary(None) {
         ffi_return_string!(binding.userid().value())
     } else {
         ptr::null_mut()
@@ -407,7 +407,7 @@ pub extern "C" fn pgp_cert_user_id_binding_iter(cert: *const Cert)
     -> *mut UserIDBindingIter<'static>
 {
     let cert = cert.ref_raw();
-    box_raw!(cert.userids())
+    box_raw!(cert.userids().components())
 }
 
 /// Frees a pgp_user_id_binding_iter_t.
diff --git a/openpgp/examples/web-of-trust.rs b/openpgp/examples/web-of-trust.rs
index a4fe3d0f..7ef155b1 100644
--- a/openpgp/examples/web-of-trust.rs
+++ b/openpgp/examples/web-of-trust.rs
@@ -38,7 +38,7 @@ fn main() {
             match cert {
                 Ok(cert) => {
                     let keyid = cert.keyid();
-                    for uidb in cert.userids() {
+                    for uidb in cert.userids().components() {
                         for tps in uidb.certifications() {
                             for issuer in tps.get_issuers() {
                                 println!("{}, {:?}, {}",
diff --git a/openpgp/src/autocrypt.rs b/openpgp/src/autocrypt.rs
index 5e092f23..9a6348df 100644
--- a/openpgp/src/autocrypt.rs
+++ b/openpgp/src/autocrypt.rs
@@ -126,13 +126,13 @@ impl AutocryptHeader {
         }
 
         // The UserIDs matching ADDR.
-        for uidb in cert.userids() {
+        for uidb in cert.userids().policy(None) {
             // XXX: Fix match once we have the rfc2822-name-addr.
             if let Ok(Some(a)) = uidb.userid().email() {
                 if &a == addr {
                     acc.push(uidb.userid().clone().into());
-                    uidb.self_signatures().iter().take(1)
-                        .for_each(|s| acc.push(s.clone().into()));
+                    uidb.binding_signature().iter()
+                        .for_each(|&s| acc.push(s.clone().into()));
                 } else {
                     // Address is not matching.
                     continue;
@@ -908,7 +908,7 @@ In the light of the Efail vulnerability I am asking myself if it's
         assert_eq!(cert.primary().fingerprint(),
                    Fingerprint::from_hex(
                        &"156962B0F3115069ACA970C68E3B03A279B772D6"[..]).unwrap());
-        assert_eq!(cert.userids().next().unwrap().userid().value(),
+        assert_eq!(cert.userids().next().unwrap().value(),
                    &b"holger krekel <holger@merlinux.eu>"[..]);
 
 
@@ -931,7 +931,7 @@ In the light of the Efail vulnerability I am asking myself if it's
         assert_eq!(cert.primary().fingerprint(),
                    Fingerprint::from_hex(
                        &"D4AB192964F76A7F8F8A9B357BD18320DEADFA11"[..]).unwrap());
-        assert_eq!(cert.userids().next().unwrap().userid().value(),
+        assert_eq!(cert.userids().next().unwrap().value(),
                    &b"Vincent Breitmoser <look@my.amazin.horse>"[..]);
 
 
@@ -954,7 +954,7 @@ In the light of the Efail vulnerability I am asking myself if it's
         assert_eq!(cert.primary().fingerprint(),
                    Fingerprint::from_hex(
                        &"4F9F89F5505AC1D1A260631CDB1187B9DD5F693B"[..]).unwrap());
-        assert_eq!(cert.userids().next().unwrap().userid().value(),
+        assert_eq!(cert.userids().next().unwrap().value(),
                    &b"Patrick Brunschwig <patrick@enigmail.net>"[..]);
 
         let ac2 = AutocryptHeaders::from_bytes(&PATRICK_UNFOLDED[..]).unwrap();
@@ -1090,7 +1090,7 @@ In the light of the Efail vulnerability I am asking myself if it's
                    "3E88 77C8 7727 4692 9751  89F5 D03F 6F86 5226 FE8B");
         assert_eq!(cert.userids().len(), 1);
         assert_eq!(cert.subkeys().len(), 1);
-        assert_eq!(cert.userids().next().unwrap().userid().value(),
+        assert_eq!(cert.userids().next().unwrap().value(),
                    &b"Testy McTestface <testy@example.org>"[..]);
     }
 }
diff --git a/openpgp/src/cert/bindings.rs b/openpgp/src/cert/bindings.rs
index 204c38be..a5493a8b 100644
--- a/openpgp/src/cert/bindings.rs
+++ b/openpgp/src/cert/bindings.rs
@@ -161,7 +161,7 @@ impl UserID {
     ///
     /// // Alice now certifies the binding between `bob@example.org` and `bob`.
     /// let certificate =
-    ///     bob.userids().nth(0).unwrap().userid()
+    ///     bob.userids().nth(0).unwrap()
     ///     .certify(&mut keypair, &bob, SignatureType::PositiveCertification,
     ///              None, None)?;
     ///
@@ -169,7 +169,8 @@ impl UserID {
     /// let bob = bob.merge_packets(vec![certificate.into()])?;
     ///
     /// // Check that we have a certification on the userid.
-    /// assert_eq!(bob.userids().nth(0).unwrap().certifications().len(), 1);
+    /// assert_eq!(bob.userids().components().nth(0).unwrap()
+    ///            .certifications().len(), 1);
     /// # Ok(()) }
     pub fn certify<S, H, T>(&self, signer: &mut dyn Signer, cert: &Cert,
                             signature_type: S,
diff --git a/openpgp/src/cert/builder.rs b/openpgp/src/cert/builder.rs
index 72dc754d..24172b0b 100644
--- a/openpgp/src/cert/builder.rs
+++ b/openpgp/src/cert/builder.rs
@@ -477,7 +477,7 @@ mod tests {
             .add_certification_subkey()
             .generate().unwrap();
 
-        let mut userids = cert.userids()
+        let mut userids = cert.userids().policy(None)
             .map(|u| String::from_utf8_lossy(u.userid().value()).into_owned())
             .collect::<Vec<String>>();
         userids.sort();
@@ -714,8 +714,8 @@ mod tests {
 
         // UserIDs.
         assert_eq!(cert.userids().count(), 1);
-        for ui in cert.userids() {
-            assert_eq!(ui.binding_signature(None).unwrap()
+        for ui in cert.userids().policy(None) {
+            assert_eq!(ui.binding_signature().unwrap()
                        .signature_creation_time().unwrap(), UNIX_EPOCH);
         }
     }
diff --git a/openpgp/src/cert/mod.rs b/openpgp/src/cert/mod.rs
index a85e996b..bbc62af8 100644
--- a/openpgp/src/cert/mod.rs
+++ b/openpgp/src/cert/mod.rs
@@ -43,7 +43,6 @@ use components::{
     PrimaryKeyBinding,
     KeyBindingIter,
     UserIDBinding,
-    UserIDBindingIter,
     UnknownBindingIter,
 };
 mod component_iter;
@@ -286,7 +285,7 @@ type UnknownBindings = ComponentBindings<Unknown>;
 ///     for s in cert.other_revocations()  { acc.push(s.clone().into()) }
 ///
 ///     // UserIDs and related signatures.
-///     for c in cert.userids() {
+///     for c in cert.userids().components() {
 ///         acc.push(c.userid().clone().into());
 ///         for s in c.self_signatures()   { acc.push(s.clone().into()) }
 ///         for s in c.certifications()    { acc.push(s.clone().into()) }
@@ -350,7 +349,7 @@ type UnknownBindings = ComponentBindings<Unknown>;
 /// match Cert::from_packet_parser(ppr) {
 ///     Ok(cert) => {
 ///         println!("Key: {}", cert.primary());
-///         for binding in cert.userids() {
+///         for binding in cert.userids().components() {
 ///             println!("User ID: {}", binding.userid());
 ///         }
 ///     }
@@ -447,57 +446,12 @@ impl Cert {
         -> Option<(&UserIDBinding, &Signature, RevocationStatus)>
         where T: Into<Option<time::SystemTime>>
     {
-        let t = t.into()
-            .unwrap_or_else(|| time::SystemTime::now());
-        self.userids()
-            // Filter out User IDs that are not alive at time `t`.
-            //
-            // While we have the binding signature, extract a few
-            // properties to avoid recomputing the same thing multiple
-            // times.
-            .filter_map(|b| {
-                // No binding signature at time `t` => not alive.
-                let selfsig = b.binding_signature(t)?;
-
-                if !selfsig.signature_alive(t, time::Duration::new(0, 0)).is_ok() {
-                    return None;
-                }
-
-                let revoked = b.revoked(t);
-                let primary = selfsig.primary_userid().unwrap_or(false);
-                let signature_creation_time = selfsig.signature_creation_time()?;
-
-                Some(((b, selfsig, revoked), primary, signature_creation_time))
-            })
-            .max_by(|(a, a_primary, a_signature_creation_time),
-                    (b, b_primary, b_signature_creation_time)| {
-                match (destructures_to!(RevocationStatus::Revoked(_) = &a.2),
-                       destructures_to!(RevocationStatus::Revoked(_) = &b.2)) {
-                    (true, false) => return Ordering::Less,
-                    (false, true) => return Ordering::Greater,
-                    _ => (),
-                }
-                match (a_primary, b_primary) {
-                    (true, false) => return Ordering::Greater,
-                    (false, true) => return Ordering::Less,
-                    _ => (),
-                }
-                match a_signature_creation_time.cmp(&b_signature_creation_time) {
-                    Ordering::Less => return Ordering::Less,
-                    Ordering::Greater => return Ordering::Greater,
-                    Ordering::Equal => (),
-                }
-
-                // Fallback to a lexographical comparison.  Prefer
-                // the "smaller" one.
-                match a.0.userid().value().cmp(&b.0.userid().value()) {
-                    Ordering::Less => return Ordering::Greater,
-                    Ordering::Greater => return Ordering::Less,
-                    Ordering::Equal =>
-                        panic!("non-canonicalized Cert (duplicate User IDs)"),
-                }
-            })
-            .map(|b| b.0)
+        self.userids().primary(t).and_then(|ca| {
+            let binding = ca.component();
+            let sig = ca.binding_signature()?;
+            let revoked = ca.revoked();
+            Some((binding, sig, revoked))
+        })
     }
 
     /// Returns the primary key's current self-signature as of `t`.
@@ -736,8 +690,12 @@ impl Cert {
     }
 
     /// Returns an iterator over the Cert's `UserIDBinding`s.
-    pub fn userids(&self) -> UserIDBindingIter {
-        UserIDBindingIter { iter: Some(self.userids.iter()) }
+    pub fn userids(&self) -> ComponentIter<UserID> {
+        fn make_iter(c: &Cert)
+                     -> std::slice::Iter<ComponentBinding<UserID>> {
+            c.userids.iter()
+        }
+        ComponentIter::new(self, make_iter)
     }
 
     /// Returns an iterator over the Cert's valid `UserAttributeBinding`s.
@@ -1740,7 +1698,7 @@ mod test {
             .unwrap();
 
         let mut userids = cert.userids()
-            .map(|u| String::from_utf8_lossy(u.userid().value()).into_owned())
+            .map(|u| String::from_utf8_lossy(u.value()).into_owned())
             .collect::<Vec<String>>();
         userids.sort();
 
@@ -1769,7 +1727,7 @@ mod test {
             Cert::from_bytes(crate::tests::key("dkg-sigs-out-of-order.pgp")).unwrap();
 
         let mut userids = cert.userids()
-            .map(|u| String::from_utf8_lossy(u.userid().value()).into_owned())
+            .map(|u| String::from_utf8_lossy(u.value()).into_owned())
             .collect::<Vec<String>>();
         userids.sort();
 
@@ -2062,12 +2020,12 @@ mod test {
                            "{:#?}", cert);
             }
 
-            for userid in cert.userids() {
-                let typ = userid.binding_signature(None).unwrap().typ();
+            for userid in cert.userids().policy(None) {
+                let typ = userid.binding_signature().unwrap().typ();
                 assert_eq!(typ, SignatureType::PositiveCertification,
                            "{:#?}", cert);
 
-                let revoked = userid.revoked(None);
+                let revoked = userid.revoked();
                 if userid_revoked {
                     assert_match!(RevocationStatus::Revoked(_) = revoked);
                 } else {
@@ -2216,8 +2174,8 @@ mod test {
             .generate().unwrap();
 
         let sig = {
-            let uid = cert.userids().skip(1).next().unwrap();
-            assert_eq!(RevocationStatus::NotAsFarAsWeKnow, uid.revoked(None));
+            let uid = cert.userids().policy(None).nth(1).unwrap();
+            assert_eq!(RevocationStatus::NotAsFarAsWeKnow, uid.revoked());
 
             let mut keypair = cert.primary().clone().mark_parts_secret()
                 .unwrap().into_keypair().unwrap();
@@ -2233,8 +2191,8 @@ mod test {
         assert_eq!(RevocationStatus::NotAsFarAsWeKnow,
                    cert.revoked(None));
 
-        let uid = cert.userids().skip(1).next().unwrap();
-        assert_match!(RevocationStatus::Revoked(_) = uid.revoked(None));
+        let uid = cert.userids().policy(None).nth(1).unwrap();
+        assert_match!(RevocationStatus::Revoked(_) = uid.revoked());
     }
 
     #[test]
@@ -2427,24 +2385,24 @@ mod test {
 
             let mut slim_shady = false;
             let mut eminem = false;
-            for b in cert.userids() {
+            for b in cert.userids().policy(t) {
                 if b.userid().value() == b"Slim Shady" {
                     assert!(!slim_shady);
                     slim_shady = true;
 
                     if revoked {
                         assert_match!(RevocationStatus::Revoked(_)
-                                      = b.revoked(t));
+                                      = b.revoked());
                     } else {
                         assert_match!(RevocationStatus::NotAsFarAsWeKnow
-                                      = b.revoked(t));
+                                      = b.revoked());
                     }
                 } else {
                     assert!(!eminem);
                     eminem = true;
 
                     assert_match!(RevocationStatus::NotAsFarAsWeKnow
-                                  = b.revoked(t));
+                                  = b.revoked());
                 }
             }
 
@@ -2487,8 +2445,8 @@ mod test {
 
             let now = time::SystemTime::now();
             let selfsig0
-                = cert.userids().map(|b| {
-                    b.binding_signature(now).unwrap()
+                = cert.userids().policy(now).map(|b| {
+                    b.binding_signature().unwrap()
                         .signature_creation_time().unwrap()
                 })
                 .max().unwrap();
@@ -2544,8 +2502,8 @@ mod test {
         let cert =
             Cert::from_bytes(crate::tests::key("un-revoked-userid.pgp")).unwrap();
 
-        for uid in cert.userids() {
-            assert_eq!(uid.revoked(None), RevocationStatus::NotAsFarAsWeKnow);
+        for uid in cert.userids().policy(None) {
+            assert_eq!(uid.revoked(), RevocationStatus::NotAsFarAsWeKnow);
         }
     }
 
@@ -2686,7 +2644,7 @@ Pu1xwz57O4zo1VYf6TqHJzVC3OMvMUM2hhdecMUe5x6GorNaj6g=
         // than one signature.
         let mut cmps = 0;
 
-        for uid in neal.userids() {
+        for uid in neal.userids().components() {
             for sigs in [
                 uid.self_signatures(),
                     uid.certifications(),
@@ -2737,8 +2695,8 @@ Pu1xwz57O4zo1VYf6TqHJzVC3OMvMUM2hhdecMUe5x6GorNaj6g=
 
         let now = time::SystemTime::now();
         let selfsig0
-            = cert.userids().map(|b| {
-                b.binding_signature(now).unwrap()
+            = cert.userids().policy(now).map(|b| {
+                b.binding_signature().unwrap()
                     .signature_creation_time().unwrap()
             })
             .max().unwrap();
@@ -2793,8 +2751,8 @@ Pu1xwz57O4zo1VYf6TqHJzVC3OMvMUM2hhdecMUe5x6GorNaj6g=
         let cert = Cert::from_bytes(
             crate::tests::key("primary-key-0-public.pgp")).unwrap();
         let selfsig0
-            = cert.userids().map(|b| {
-                b.binding_signature(now).unwrap()
+            = cert.userids().policy(now).map(|b| {
+                b.binding_signature().unwrap()
                     .signature_creation_time().unwrap()
             })
             .max().unwrap();
@@ -2951,7 +2909,7 @@ Pu1xwz57O4zo1VYf6TqHJzVC3OMvMUM2hhdecMUe5x6GorNaj6g=
                 .generate().unwrap();
 
             assert_eq!(bob.userids().len(), 1);
-            let bob_userid_binding = bob.userids().nth(0).unwrap();
+            let bob_userid_binding = bob.userids().components().nth(0).unwrap();
             assert_eq!(bob_userid_binding.userid().value(), b"bob@bar.com");
 
             let sig_template
@@ -2974,7 +2932,7 @@ Pu1xwz57O4zo1VYf6TqHJzVC3OMvMUM2hhdecMUe5x6GorNaj6g=
             // Make sure the certification is merged, and put in the right
             // place.
             assert_eq!(bob.userids().len(), 1);
-            let bob_userid_binding = bob.userids().nth(0).unwrap();
+            let bob_userid_binding = bob.userids().components().nth(0).unwrap();
             assert_eq!(bob_userid_binding.userid().value(), b"bob@bar.com");
 
             // Canonicalizing Bob's cert without having Alice's key
diff --git a/openpgp/src/cert/parser/mod.rs b/openpgp/src/cert/parser/mod.rs
index 45786aad..3f509310 100644
--- a/openpgp/src/cert/parser/mod.rs
+++ b/openpgp/src/cert/parser/mod.rs
@@ -402,8 +402,8 @@ enum PacketSource<'a, I: Iterator<Item=Packet>> {
 ///     match certo {
 ///         Ok(cert) => {
 ///             println!("Key: {}", cert.primary());
-///             for binding in cert.userids() {
-///                 println!("User ID: {}", binding.userid());
+///             for uid in cert.userids() {
+///                 println!("User ID: {}", uid);
 ///             }
 ///         }
 ///         Err(err) => {
diff --git a/openpgp/src/cert/revoke.rs b/openpgp/src/cert/revoke.rs
index d2c1bb82..55aa9c31 100644
--- a/openpgp/src/cert/revoke.rs
+++ b/openpgp/src/cert/revoke.rs
@@ -284,15 +284,15 @@ impl Deref for SubkeyRevocationBuilder {
 ///         .set_reason_for_revocation(
 ///             ReasonForRevocation::KeyRetired,
 ///             b"Left example.org.").unwrap()
-///         .build(&mut keypair, &cert, userid.userid(), None)?;
+///         .build(&mut keypair, &cert, userid, None)?;
 /// assert_eq!(revocation.typ(), SignatureType::CertificationRevocation);
 ///
 /// // Now merge the revocation signature into the Cert.
 /// let cert = cert.merge_packets(vec![revocation.clone().into()])?;
 ///
 /// // Check that it is revoked.
-/// let userid = cert.userids().nth(0).unwrap();
-/// if let RevocationStatus::Revoked(revocations) = userid.revoked(None) {
+/// let userid = cert.userids().policy(None).nth(0).unwrap();
+/// if let RevocationStatus::Revoked(revocations) = userid.revoked() {
 ///     assert_eq!(revocations.len(), 1);
 ///     assert_eq!(*revocations[0], revocation);
 /// } else {
diff --git a/openpgp/src/crypto/hash.rs b/openpgp/src/crypto/hash.rs
index 4fc86a87..685c433d 100644
--- a/openpgp/src/crypto/hash.rs
+++ b/openpgp/src/crypto/hash.rs
@@ -491,7 +491,7 @@ mod test {
     fn hash_verification() {
         fn check(cert: Cert) -> (usize, usize, usize) {
             let mut userid_sigs = 0;
-            for (i, binding) in cert.userids().enumerate() {
+            for (i, binding) in cert.userids().components().enumerate() {
                 for selfsig in binding.self_signatures() {
                     let h = Signature::hash_userid_binding(
                         selfsig,
diff --git a/openpgp/src/serialize/cert.rs b/openpgp/src/serialize/cert.rs
index 9c41e057..c7d572a7 100644
--- a/openpgp/src/serialize/cert.rs
+++ b/openpgp/src/serialize/cert.rs
@@ -54,7 +54,7 @@ impl Cert {
             serialize_sig(o, s)?;
         }
 
-        for u in self.userids() {
+        for u in self.userids().components() {
             if export && ! u.self_signatures().iter().chain(u.self_revocations()).any(
                 |s| s.exportable_certification().unwrap_or(true))
             {
@@ -173,7 +173,7 @@ impl SerializeInto for Cert {
             l += PacketRef::Signature(s).serialized_len();
         }
 
-        for u in self.userids() {
+        for u in self.userids().components() {
             l += PacketRef::UserID(u.userid()).serialized_len();
 
             for s in u.self_revocations() {
@@ -400,7 +400,7 @@ impl<'a> TSK<'a> {
             serialize_sig(o, s)?;
         }
 
-        for u in self.cert.userids() {
+        for u in self.cert.userids().components() {
             if export && ! u.self_signatures().iter().chain(u.self_revocations()).any(
                 |s| s.exportable_certification().unwrap_or(true))
             {
@@ -553,7 +553,7 @@ impl<'a> SerializeInto for TSK<'a> {
             l += PacketRef::Signature(s).serialized_len();
         }
 
-        for u in self.cert.userids() {
+        for u in self.cert.userids().components() {
             l += PacketRef::UserID(u.userid()).serialized_len();
 
             for s in u.self_revocations() {
@@ -768,7 +768,7 @@ mod test {
         assert_eq!(cert.subkeys().count(), 1);
         assert!(cert.subkeys().nth(0).unwrap().binding_signature(None).is_some());
         assert_eq!(cert.userids().count(), 1);
-        assert!(cert.userids().nth(0).unwrap().binding_signature(None).is_some());
+        assert!(cert.userids().policy(None).nth(0).is_some());
         assert_eq!(cert.user_attributes().count(), 1);
         assert!(cert.user_attributes().policy(None).nth(0).is_some());
 
diff --git a/openpgp/src/serialize/cert_armored.rs b/openpgp/src/serialize/cert_armored.rs
index 480c232b..c8da915c 100644
--- a/openpgp/src/serialize/cert_armored.rs
+++ b/openpgp/src/serialize/cert_armored.rs
@@ -29,7 +29,7 @@ impl Cert {
     pub fn armor_headers(&self) -> Vec<String> {
         let length_value = armor::LINE_LENGTH - "Comment: ".len();
         // Create a header per userid.
-        let mut headers: Vec<String> = self.userids()