Call TPKs Certificates, update identifiers, documentation.

  - Fixes #387.

11 files changed, 134 insertions, 134 deletions

diff --git a/ffi/examples/keyserver.c b/ffi/examples/keyserver.c
index 715795d8..64c90cdc 100644
--- a/ffi/examples/keyserver.c
+++ b/ffi/examples/keyserver.c
@@ -22,7 +22,7 @@ main (int argc, char **argv)
   sq_context_t ctx;
   pgp_keyid_t id;
   sq_keyserver_t ks;
-  pgp_tpk_t tpk;
+  pgp_cert_t cert;
 
   ctx = sq_context_new (&err);
   if (ctx == NULL)
@@ -37,18 +37,18 @@ main (int argc, char **argv)
     }
 
   id = pgp_keyid_from_bytes ((uint8_t *) "\x24\x7F\x6D\xAB\xC8\x49\x14\xFE");
-  tpk = sq_keyserver_get (ctx, ks, id);
-  if (tpk == NULL)
+  cert = sq_keyserver_get (ctx, ks, id);
+  if (cert == NULL)
     {
       pgp_error_t err = sq_context_last_error (ctx);
       error (1, 0, "Failed to retrieve key: %s", pgp_error_to_string (err));
     }
 
-  char *debug = pgp_tpk_debug (tpk);
+  char *debug = pgp_cert_debug (cert);
   printf ("%s", debug);
   free (debug);
 
-  pgp_tpk_free (tpk);
+  pgp_cert_free (cert);
   pgp_keyid_free (id);
   sq_keyserver_free (ks);
   sq_context_free (ctx);
diff --git a/ffi/include/sequoia/net.h b/ffi/include/sequoia/net.h
index 8b74f727..63311d85 100644
--- a/ffi/include/sequoia/net.h
+++ b/ffi/include/sequoia/net.h
@@ -53,7 +53,7 @@ void sq_keyserver_free (sq_keyserver_t ks);
 ///
 /// Returns `NULL` on errors.
 /*/
-pgp_tpk_t sq_keyserver_get (sq_context_t ctx,
+pgp_cert_t sq_keyserver_get (sq_context_t ctx,
 			   sq_keyserver_t ks,
 			   const pgp_keyid_t id);
 
@@ -64,6 +64,6 @@ pgp_tpk_t sq_keyserver_get (sq_context_t ctx,
 /*/
 pgp_status_t sq_keyserver_send (sq_context_t ctx,
 			       sq_keyserver_t ks,
-			       const pgp_tpk_t tpk);
+			       const pgp_cert_t cert);
 
 #endif
diff --git a/ffi/include/sequoia/store.h b/ffi/include/sequoia/store.h
index 38eb04d0..694aa32c 100644
--- a/ffi/include/sequoia/store.h
+++ b/ffi/include/sequoia/store.h
@@ -26,7 +26,7 @@ void sq_mapping_free (sq_mapping_t mapping);
 /*/
 /// Represents an entry in a Mapping.
 ///
-/// Mappings map labels to TPKs.  A `Binding` represents a pair in this
+/// Mappings map labels to Certs.  A `Binding` represents a pair in this
 /// relation.  We make this explicit because we associate metadata
 /// with these pairs.
 /*/
@@ -40,8 +40,8 @@ void sq_binding_free (sq_binding_t binding);
 /*/
 /// Represents a key in a mapping.
 ///
-/// A `Key` is a handle to a stored TPK.  We make this explicit
-/// because we associate metadata with TPKs.
+/// A `Key` is a handle to a stored Cert.  We make this explicit
+/// because we associate metadata with Certs.
 /*/
 typedef struct sq_key *sq_key_t;
 
@@ -257,7 +257,7 @@ sq_key_iter_t sq_store_list_keys (sq_context_t ctx);
 /// objects maintained by a background service.  The background
 /// service associates state with this name.
 ///
-/// The mapping updates TPKs in compliance with the network policy
+/// The mapping updates Certs in compliance with the network policy
 /// of the context that created the mapping in the first place.
 /// Opening the mapping with a different network policy is
 /// forbidden.
@@ -273,8 +273,8 @@ sq_binding_t sq_mapping_add (sq_context_t ctx, sq_mapping_t mapping,
 /*/
 /// Imports a key into the mapping.
 /*/
-pgp_tpk_t sq_mapping_import (sq_context_t ctx, sq_mapping_t mapping,
-			  const char *label, pgp_tpk_t tpk);
+pgp_cert_t sq_mapping_import (sq_context_t ctx, sq_mapping_t mapping,
+			  const char *label, pgp_cert_t cert);
 
 /*/
 /// Returns the binding for the given label.
@@ -320,17 +320,17 @@ sq_stats_t sq_binding_stats (sq_context_t ctx, sq_binding_t binding);
 sq_key_t sq_binding_key (sq_context_t ctx, sq_binding_t binding);
 
 /*/
-/// Returns the `pgp_tpk_t` of this binding.
+/// Returns the `pgp_cert_t` of this binding.
 /*/
-pgp_tpk_t sq_binding_tpk (sq_context_t ctx, sq_binding_t binding);
+pgp_cert_t sq_binding_cert (sq_context_t ctx, sq_binding_t binding);
 
 /*/
-/// Updates this binding with the given TPK.
+/// Updates this binding with the given Cert.
 ///
-/// If the new key `tpk` matches the current key, i.e. they have
+/// If the new key `cert` matches the current key, i.e. they have
 /// the same fingerprint, both keys are merged and normalized.
 /// The returned key contains all packets known to Sequoia, and
-/// should be used instead of `tpk`.
+/// should be used instead of `cert`.
 ///
 /// If the new key does not match the current key, but carries a
 /// valid signature from the current key, it replaces the current
@@ -342,26 +342,26 @@ pgp_tpk_t sq_binding_tpk (sq_context_t ctx, sq_binding_t binding);
 /// conflict, either by ignoring the new key, or by using
 /// `sq_binding_rotate` to force a rotation.
 /*/
-pgp_tpk_t sq_binding_import (sq_context_t ctx, sq_binding_t binding,
-			    pgp_tpk_t tpk);
+pgp_cert_t sq_binding_import (sq_context_t ctx, sq_binding_t binding,
+			    pgp_cert_t cert);
 
 /*/
-/// Forces a keyrotation to the given TPK.
+/// Forces a keyrotation to the given Cert.
 ///
-/// The current key is replaced with the new key `tpk`, even if
+/// The current key is replaced with the new key `cert`, even if
 /// they do not have the same fingerprint.  If a key with the same
-/// fingerprint as `tpk` is already in the store, is merged with
-/// `tpk` and normalized.  The returned key contains all packets
-/// known to Sequoia, and should be used instead of `tpk`.
+/// fingerprint as `cert` is already in the store, is merged with
+/// `cert` and normalized.  The returned key contains all packets
+/// known to Sequoia, and should be used instead of `cert`.
 ///
 /// Use this function to resolve conflicts returned from
 /// `sq_binding_import`.  Make sure that you have authenticated
-/// `tpk` properly.  How to do that depends on your thread model.
+/// `cert` properly.  How to do that depends on your thread model.
 /// You could simply ask Alice to call her communication partner
 /// Bob and confirm that he rotated his keys.
 /*/
-pgp_tpk_t sq_binding_rotate (sq_context_t ctx, sq_binding_t binding,
-			    pgp_tpk_t tpk);
+pgp_cert_t sq_binding_rotate (sq_context_t ctx, sq_binding_t binding,
+			    pgp_cert_t cert);
 
 /*/
 /// Deletes this binding.
@@ -381,23 +381,23 @@ sq_log_iter_t sq_binding_log (sq_context_t ctx, sq_binding_t binding);
 sq_stats_t sq_key_stats (sq_context_t ctx, sq_key_t key);
 
 /*/
-/// Returns the `pgp_tpk_t` of this key.
+/// Returns the `pgp_cert_t` of this key.
 /*/
-pgp_tpk_t sq_key_tpk (sq_context_t ctx, sq_key_t key);
+pgp_cert_t sq_key_cert (sq_context_t ctx, sq_key_t key);
 
 /*/
-/// Updates this stored key with the given TPK.
+/// Updates this stored key with the given Cert.
 ///
-/// If the new key `tpk` matches the current key, i.e. they have
+/// If the new key `cert` matches the current key, i.e. they have
 /// the same fingerprint, both keys are merged and normalized.
 /// The returned key contains all packets known to Sequoia, and
-/// should be used instead of `tpk`.
+/// should be used instead of `cert`.
 ///
 /// If the new key does not match the current key,
 /// `Error::Conflict` is returned.
 /*/
-pgp_tpk_t sq_key_import (sq_context_t ctx, sq_key_t key,
-			pgp_tpk_t tpk);
+pgp_cert_t sq_key_import (sq_context_t ctx, sq_key_t key,
+			pgp_cert_t cert);
 
 /*/
 /// Lists all log entries related to this key.
diff --git a/ffi/lang/python/sequoia/net.py b/ffi/lang/python/sequoia/net.py
index a89c4e4f..de7a77fc 100644
--- a/ffi/lang/python/sequoia/net.py
+++ b/ffi/lang/python/sequoia/net.py
@@ -1,6 +1,6 @@
 from _sequoia import ffi, lib
 
-from .openpgp import TPK
+from .openpgp import Cert
 from .error import Error
 from .glue import SQObject
 
@@ -24,14 +24,14 @@ class KeyServer(SQObject):
                          context=ctx)
 
     def get(self, keyid):
-        return TPK(lib.sq_keyserver_get(self.context().ref(),
+        return Cert(lib.sq_keyserver_get(self.context().ref(),
                                         self.ref(),
                                         keyid.ref()),
                    context=self.context())
 
-    def send(self, tpk):
+    def send(self, cert):
         r = lib.sq_keyserver_send(self.context().ref(),
                                   self.ref(),
-                                  tpk.ref())
+                                  cert.ref())
         if r:
             raise Error._last(self.context())
diff --git a/ffi/lang/python/sequoia/openpgp.py b/ffi/lang/python/sequoia/openpgp.py
index 1c19d80a..7b36ba01 100644
--- a/ffi/lang/python/sequoia/openpgp.py
+++ b/ffi/lang/python/sequoia/openpgp.py
@@ -79,48 +79,48 @@ class PacketPile(SQObject):
         if status:
             raise Error._last(self.context())
 
-class TPK(SQObject):
-    _del = lib.pgp_tpk_free
-    _clone = lib.pgp_tpk_clone
-    _eq = lib.pgp_tpk_equal
-    _str = lib.pgp_tpk_to_string
-    _debug = lib.pgp_tpk_debug
+class Cert(SQObject):
+    _del = lib.pgp_cert_free
+    _clone = lib.pgp_cert_clone
+    _eq = lib.pgp_cert_equal
+    _str = lib.pgp_cert_to_string
+    _debug = lib.pgp_cert_debug
 
     @classmethod
     def from_reader(cls, ctx, reader):
-        return TPK(invoke(lib.pgp_tpk_from_reader, reader.ref()),
+        return Cert(invoke(lib.pgp_cert_from_reader, reader.ref()),
                    context=ctx)
 
     @classmethod
     def open(cls, ctx, filename):
-        return TPK(invoke(lib.pgp_tpk_from_file, filename.encode()),
+        return Cert(invoke(lib.pgp_cert_from_file, filename.encode()),
                    context=ctx)
 
     @classmethod
     def from_packet_pile(cls, ctx, packet_pile):
-        return TPK(invoke(lib.pgp_tpk_from_packet_pile, packet_pile.ref_consume()),
+        return Cert(invoke(lib.pgp_cert_from_packet_pile, packet_pile.ref_consume()),
                    context=ctx)
 
     @classmethod
     def from_bytes(cls, ctx, source):
-        return TPK(invoke(lib.pgp_tpk_from_bytes,
+        return Cert(invoke(lib.pgp_cert_from_bytes,
                           ffi.from_buffer(source),
                           len(source)),
                    context=ctx)
 
     def serialize(self, writer):
-        status = invoke(lib.pgp_tpk_serialize,
+        status = invoke(lib.pgp_cert_serialize,
                         self.ref(),
                         writer.ref())
         if status:
             raise Error._last(self.context())
 
     def fingerprint(self):
-        return Fingerprint(lib.pgp_tpk_fingerprint(self.ref()),
+        return Fingerprint(lib.pgp_cert_fingerprint(self.ref()),
                            context=self.context())
 
     def merge(self, other):
-        new = invoke(lib.pgp_tpk_merge,
+        new = invoke(lib.pgp_cert_merge,
                      self.ref_consume(),
                      other.ref_consume())
         if new == ffi.NULL:
diff --git a/ffi/lang/python/sequoia/store.py b/ffi/lang/python/sequoia/store.py
index 6cf4347b..97c601ec 100644
--- a/ffi/lang/python/sequoia/store.py
+++ b/ffi/lang/python/sequoia/store.py
@@ -2,7 +2,7 @@ from _sequoia import ffi, lib
 
 from .error import Error
 from .glue import _str, _static_str, SQObject, sq_iterator, sq_time
-from .openpgp import Fingerprint, TPK
+from .openpgp import Fingerprint, Cert
 
 class Store(object):
     @classmethod
@@ -50,9 +50,9 @@ class Mapping(SQObject):
                                         label.encode(), fingerprint.ref()),
                        context=self.context())
 
-    def import_(self, label, tpk):
-        return TPK(lib.sq_mapping_import(self.context().ref(), self.ref(),
-                                       label.encode(), tpk.ref()),
+    def import_(self, label, cert):
+        return Cert(lib.sq_mapping_import(self.context().ref(), self.ref(),
+                                       label.encode(), cert.ref()),
                    context=self.context())
 
     def lookup(self, label):
@@ -102,16 +102,16 @@ class Binding(SQObject):
         return Key(lib.sq_binding_key(self.context().ref(), self.ref()),
                    self.context())
 
-    def tpk(self):
-        return TPK(lib.sq_binding_tpk(self.context().ref(), self.ref()),
+    def cert(self):
+        return Cert(lib.sq_binding_cert(self.context().ref(), self.ref()),
                    self.context())
 
-    def import_(self, tpk):
-        return TPK(lib.sq_binding_import(self.context().ref(), self.ref(), tpk),
+    def import_(self, cert):
+        return Cert(lib.sq_binding_import(self.context().ref(), self.ref(), cert),
                    self.context())
 
-    def rotate(self, tpk):
-        return TPK(lib.sq_binding_rotate(self.context().ref(), self.ref(), tpk),
+    def rotate(self, cert):
+        return Cert(lib.sq_binding_rotate(self.context().ref(), self.ref(), cert),
                    self.context())
 
     def delete(self):
@@ -134,12 +134,12 @@ class Key(SQObject):
         return Stats(lib.sq_key_stats(self.context().ref(), self.ref()),
                      self.context())
 
-    def tpk(self):
-        return TPK(lib.sq_key_tpk(self.context().ref(), self.ref()),
+    def cert(self):
+        return Cert(lib.sq_key_cert(self.context().ref(), self.ref()),
                    self.context())
 
-    def import_(self, tpk):
-        return TPK(lib.sq_key_import(self.context().ref(), self.ref(), tpk),
+    def import_(self, cert):
+        return Cert(lib.sq_key_import(self.context().ref(), self.ref(), cert),
                    self.context())
 
     def log(self):
diff --git a/ffi/lang/python/tests/test_tpk.py b/ffi/lang/python/tests/test_cert.py
index 5e06bd93..8c38f205 100644
--- a/ffi/lang/python/tests/test_tpk.py
+++ b/ffi/lang/python/tests/test_cert.py
@@ -2,7 +2,7 @@ from os.path import join
 from tempfile import TemporaryDirectory
 
 from sequoia.core import Context, NetworkPolicy, Reader, Writer
-from sequoia.openpgp import ArmorReader, Fingerprint, TPK, PacketPile
+from sequoia.openpgp import ArmorReader, Fingerprint, Cert, PacketPile
 
 pgp = "../../../openpgp/tests/data/keys/testy.pgp"
 asc = "../../../openpgp/tests/data/keys/testy.asc"
@@ -12,7 +12,7 @@ def test_from_reader():
     ctx = Context(network_policy=NetworkPolicy.Offline,
                   ephemeral=True)
     r = Reader.open(ctx, pgp)
-    t = TPK.from_reader(ctx, r)
+    t = Cert.from_reader(ctx, r)
     assert t.fingerprint() == fp
 
 def test_from_armor_reader():
@@ -21,26 +21,26 @@ def test_from_armor_reader():
     k = open(asc, "rb").read()
     r = Reader.from_bytes(ctx, k)
     r = ArmorReader.new(ctx, r)
-    t = TPK.from_reader(ctx, r)
+    t = Cert.from_reader(ctx, r)
     assert t.fingerprint() == fp
 
 def test_from_file():
     ctx = Context(network_policy=NetworkPolicy.Offline,
                   ephemeral=True)
-    t = TPK.open(ctx, pgp)
+    t = Cert.open(ctx, pgp)
     assert t.fingerprint() == fp
 
 def test_from_packet_pile():
     ctx = Context(network_policy=NetworkPolicy.Offline,
                   ephemeral=True)
     r = PacketPile.open(ctx, pgp)
-    t = TPK.from_packet_pile(ctx, r)
+    t = Cert.from_packet_pile(ctx, r)
     assert t.fingerprint() == fp
 
 def test_from_bytes():
     ctx = Context(network_policy=NetworkPolicy.Offline,
                   ephemeral=True)
-    t = TPK.from_bytes(ctx, open(pgp, "rb").read())
+    t = Cert.from_bytes(ctx, open(pgp, "rb").read())
     assert t.fingerprint() == fp
 
 def test_from_serialize():
@@ -49,25 +49,25 @@ def test_from_serialize():
     with TemporaryDirectory() as tmp:
         sink = join(tmp, "a")
 
-        t = TPK.open(ctx, pgp)
+        t = Cert.open(ctx, pgp)
         with Writer.open(ctx, sink) as s:
             t.serialize(s)
 
-        t = TPK.open(ctx, sink)
+        t = Cert.open(ctx, sink)
         assert t.fingerprint() == fp
 
 def test_equals():
     ctx = Context(network_policy=NetworkPolicy.Offline,
                   ephemeral=True)
     b = open(pgp, "rb").read()
-    t = TPK.from_bytes(ctx, b)
-    u = TPK.from_bytes(ctx, b)
+    t = Cert.from_bytes(ctx, b)
+    u = Cert.from_bytes(ctx, b)
     assert t == u
 
 def test_clone():
     ctx = Context(network_policy=NetworkPolicy.Offline,
                   ephemeral=True)
-    a = TPK.open(ctx, pgp)
+    a = Cert.open(ctx, pgp)
     b = a.copy()
     del a
     c = b.copy()
diff --git a/ffi/src/error.rs b/ffi/src/error.rs
index f68f4c3d..884e28d1 100644
--- a/ffi/src/error.rs
+++ b/ffi/src/error.rs
@@ -64,12 +64,12 @@ impl<'a> FromSequoiaError<'a> for Status {
                     Status::ManipulatedMessage,
                 &openpgp::Error::MalformedMessage(_) =>
                     Status::MalformedMessage,
-                &openpgp::Error::MalformedTPK(_) =>
-                    Status::MalformedTPK,
+                &openpgp::Error::MalformedCert(_) =>
+                    Status::MalformedCert,
                 &openpgp::Error::IndexOutOfRange =>
                     Status::IndexOutOfRange,
-                &openpgp::Error::UnsupportedTPK(_) =>
-                    Status::UnsupportedTPK,
+                &openpgp::Error::UnsupportedCert(_) =>
+                    Status::UnsupportedCert,
             }
         }
 
diff --git a/ffi/src/lib.rs b/ffi/src/lib.rs
index 92cfab0d..0bf46056 100644
--- a/ffi/src/lib.rs
+++ b/ffi/src/lib.rs
@@ -96,13 +96,13 @@
 //! #include <error.h>
 //!
 //! pgp_error_t err;
-//! pgp_tpk_t tpk;
+//! pgp_cert_t cert;
 //!
-//! tpk = pgp_tpk_from_file (&err, "../openpgp/tests/data/keys/testy.pgp");
-//! if (tpk == NULL)
-//!   error (1, 0, "pgp_tpk_from_bytes: %s", pgp_error_to_string (err));
+//! cert = pgp_cert_from_file (&err, "../openpgp/tests/data/keys/testy.pgp");
+//! if (cert == NULL)
+//!   error (1, 0, "pgp_cert_from_bytes: %s", pgp_error_to_string (err));
 //!
-//! pgp_tpk_free (tpk);
+//! pgp_cert_free (cert);
 //! ```
 
 #![warn(missing_docs)]
diff --git a/ffi/src/net.rs b/ffi/src/net.rs
index f697dd35..ae297d4b 100644
--- a/ffi/src/net.rs
+++ b/ffi/src/net.rs
@@ -19,14 +19,14 @@
 //! sq_context_t ctx;
 //! pgp_keyid_t id;
 //! sq_keyserver_t ks;
-//! pgp_tpk_t tpk;
+//! pgp_cert_t cert;
 //!
 //! ctx = sq_context_new (NULL);
 //! ks = sq_keyserver_keys_openpgp_org (ctx);
 //! id = pgp_keyid_from_bytes ((uint8_t *) "\x24\x7F\x6D\xAB\xC8\x49\x14\xFE");
-//! tpk = sq_keyserver_get (ctx, ks, id);
+//! cert = sq_keyserver_get (ctx, ks, id);
 //!
-//! pgp_tpk_free (tpk);
+//! pgp_cert_free (cert);
 //! pgp_keyid_free (id);
 //! sq_keyserver_free (ks);
 //! sq_context_free (ctx);
@@ -45,7 +45,7 @@ use sequoia_net::KeyServer;
 use super::error::Status;
 use super::core::Context;
 use crate::openpgp::keyid::KeyID;
-use crate::openpgp::tpk::TPK;
+use crate::openpgp::cert::Cert;
 use crate::RefRaw;
 use crate::MoveResultIntoRaw;
 use crate::Maybe;
@@ -120,7 +120,7 @@ fn sq_keyserver_free(ks: Option<&mut KeyServer>) {
 fn sq_keyserver_get(ctx: *mut Context,
                     ks: *mut KeyServer,
                     id: *const KeyID)
-                    -> Maybe<TPK> {
+                    -> Maybe<Cert> {
     let ctx = ffi_param_ref_mut!(ctx);
     ffi_make_fry_from_ctx!(ctx);
     let ks = ffi_param_ref_mut!(ks);
@@ -136,14 +136,14 @@ fn sq_keyserver_get(ctx: *mut Context,
 #[::sequoia_ffi_macros::extern_fn] #[no_mangle] pub extern "C"
 fn sq_keyserver_send(ctx: *mut Context,
                      ks: *mut KeyServer,
-                     tpk: *const TPK)
+                     cert: *const Cert)
                      -> Status {
     let ctx = ffi_param_ref_mut!(ctx);
     ffi_make_fry_from_ctx!(ctx);
     let ks = ffi_param_ref_mut!(ks);
-    let tpk = tpk.ref_raw();
+    let cert = cert.ref_raw();
 
     ffi_try_status!(tokio_core::reactor::Core::new()
                     .map_err(|e| e.into())
-                    .and_then(|mut core| core.run(ks.send(tpk))))
+                    .and_then(|mut core| core.run(ks.send(cert))))
 }
diff --git a/ffi/src/store.rs b/ffi/src/store.rs
index 8f273258..d0401d01 100644
--- a/ffi/src/store.rs
+++ b/ffi/src/store.rs
@@ -1,6 +1,6 @@
-//! For storing transferable public keys.
+//! For storing OpenPGP certificates.
 //!
-//! The key store stores transferable public keys (TPKs) using an
+//! The key store stores OpenPGP Certificates ("Certs") using an
 //! arbitrary label.  Stored keys are automatically updated from
 //! remote sources.  This ensures that updates like new subkeys and
 //! revocations are discovered in a timely manner.
@@ -37,7 +37,7 @@ use super::core::Context;
 
 use crate::openpgp::fingerprint::Fingerprint;
 use crate::openpgp::keyid::KeyID;
-use crate::openpgp::tpk::TPK;
+use crate::openpgp::cert::Cert;
 use crate::RefRaw;
 use crate::MoveIntoRaw;
 use crate::MoveResultIntoRaw;
@@ -186,7 +186,7 @@ fn sq_log_iter_free(iter: Option<&mut LogIter>) {
 /// maintained by a background service.  The background service
 /// associates state with this name.
 ///
-/// The mapping updates TPKs in compliance with the network policy
+/// The mapping updates Certs in compliance with the network policy
 /// of the context that created the mapping in the first place.
 /// Opening the mapping with a different network policy is
 /// forbidden.
@@ -230,15 +230,15 @@ fn sq_mapping_add(ctx: *mut Context,
 fn sq_mapping_import(ctx: *mut Context,
                    mapping: *const Mapping,
                    label: *const c_char,
-                   tpk: *const TPK)
-                   -> Maybe<TPK> {
+                   cert: *const Cert)
+                   -> Maybe<Cert> {
     let ctx = ffi_param_ref_mut!(ctx);
     ffi_make_fry_from_ctx!(ctx);
     let mapping = ffi_param_ref!(mapping);
     let label = ffi_param_cstr!(label).to_string_lossy();
-    let tpk = tpk.ref_raw();
+    let cert = cert.ref_raw();
 
-    mapping.import(&label, tpk).move_into_raw(Some(ctx.errp()))
+    mapping.import(&label, cert).move_into_raw(Some(ctx.errp()))
 }
 
 /// Returns the binding for the given label.
@@ -409,23 +409,23 @@ fn sq_binding_key(ctx: *mut Context, binding: *const Binding)
     ffi_try_box!(binding.key())
 }
 
-/// Returns the `pgp_tpk_t` of this binding.
+/// Returns the `pgp_cert_t` of this binding.
 #[::sequoia_ffi_macros::extern_fn] #[no_mangle] pub extern "C"
-fn sq_binding_tpk(ctx: *mut Context, binding: *const Binding)
-                  -> Maybe<TPK> {
+fn sq_binding_cert(ctx: *mut Context, binding: *const Binding)
+                  -> Maybe<Cert> {
     let ctx = ffi_param_ref_mut!(ctx);
     ffi_make_fry_from_ctx!(ctx);
     let binding = ffi_param_ref!(binding);
 
-    binding.tpk().move_into_raw(Some(ctx.errp()))
+    binding.cert().move_into_raw(Some(ctx.errp()))
 }
 
-/// Updates this binding with the given TPK.
+/// Updates this binding with the given Cert.
 ///
-/// If the new key `tpk` matches the current key, i.e. they have
+/// If the new key `cert` matches the current key, i.e. they have
 /// the same fingerprint, both keys are merged and normalized.
 /// The returned key contains all packets known to Sequoia, and
-/// should be used instead of `tpk`.
+/// should be used instead of `cert`.
 ///
 /// If the new key does not match the current key, but carries a
 /// valid signature from the current key, it replaces the current
@@ -439,41 +439,41 @@ fn sq_binding_tpk(ctx: *mut Context, binding: *const Binding)
 #[::sequoia_ffi_macros::extern_fn] #[no_mangle] pub extern "C"
 fn sq_binding_import(ctx: *mut Context,
                      binding: *const Binding,
-                     tpk: *const TPK)
-                     -> Maybe<TPK> {
+                     cert: *const Cert)
+                     -> Maybe<Cert> {
     let ctx = ffi_param_ref_mut!(ctx);
     ffi_make_fry_from_ctx!(ctx);
     let binding = ffi_param_ref!(binding);
-    let tpk = tpk.ref_raw();
+    let cert = cert.ref_raw();
 
-    binding.import(&tpk).move_into_raw(Some(ctx.errp()))
+    binding.import(&cert).move_into_raw(Some(ctx.errp()))
 }
 
 
-/// Forces a keyrotation to the given TPK.
+/// Forces a keyrotation to the given Cert.
 ///
-/// The current key is replaced with the new key `tpk`, even if
+/// The current key is replaced with the new key `cert`, even if
 /// they do not have the same fingerprint.  If a key with the same
-/// fingerprint as `tpk` is already in the mapping, is merged with
-/// `tpk` and normalized.  The returned key contains all packets
-/// known to Sequoia, and should be used instead of `tpk`.
+/// fingerprint as `cert` is already in the mapping, is merged with
+/// `cert` and normalized.  The returned key contains all packets
+/// known to Sequoia, and should be used instead of `cert`.