openpgp: Rename Cert::primary to Cert::primary_key.

11 files changed, 80 insertions, 87 deletions

diff --git a/openpgp/src/autocrypt.rs b/openpgp/src/autocrypt.rs
index 9a6348df..bcad7bf5 100644
--- a/openpgp/src/autocrypt.rs
+++ b/openpgp/src/autocrypt.rs
@@ -106,7 +106,7 @@ impl AutocryptHeader {
         let mut acc = Vec::new();
 
         // The primary key and the most recent selfsig.
-        acc.push(cert.primary().clone().into());
+        acc.push(cert.primary_key().clone().into());
         cert.direct_signatures().iter().take(1)
             .for_each(|s| acc.push(s.clone().into()));
 
@@ -905,7 +905,7 @@ In the light of the Efail vulnerability I am asking myself if it's
 
         let cert = ac.headers[0].key.as_ref()
             .expect("Failed to parse key material.");
-        assert_eq!(cert.primary().fingerprint(),
+        assert_eq!(cert.fingerprint(),
                    Fingerprint::from_hex(
                        &"156962B0F3115069ACA970C68E3B03A279B772D6"[..]).unwrap());
         assert_eq!(cert.userids().next().unwrap().value(),
@@ -928,7 +928,7 @@ In the light of the Efail vulnerability I am asking myself if it's
 
         let cert = ac.headers[0].key.as_ref()
             .expect("Failed to parse key material.");
-        assert_eq!(cert.primary().fingerprint(),
+        assert_eq!(cert.fingerprint(),
                    Fingerprint::from_hex(
                        &"D4AB192964F76A7F8F8A9B357BD18320DEADFA11"[..]).unwrap());
         assert_eq!(cert.userids().next().unwrap().value(),
@@ -951,7 +951,7 @@ In the light of the Efail vulnerability I am asking myself if it's
 
         let cert = ac.headers[0].key.as_ref()
             .expect("Failed to parse key material.");
-        assert_eq!(cert.primary().fingerprint(),
+        assert_eq!(cert.primary_key().fingerprint(),
                    Fingerprint::from_hex(
                        &"4F9F89F5505AC1D1A260631CDB1187B9DD5F693B"[..]).unwrap());
         assert_eq!(cert.userids().next().unwrap().value(),
@@ -1086,7 +1086,7 @@ In the light of the Efail vulnerability I am asking myself if it's
 
         let cert = ac.headers[0].key.as_ref()
             .expect("Failed to parse key material.");
-        assert_eq!(&cert.primary().fingerprint().to_string(),
+        assert_eq!(&cert.fingerprint().to_string(),
                    "3E88 77C8 7727 4692 9751  89F5 D03F 6F86 5226 FE8B");
         assert_eq!(cert.userids().len(), 1);
         assert_eq!(cert.subkeys().len(), 1);
diff --git a/openpgp/src/cert/bindings.rs b/openpgp/src/cert/bindings.rs
index bbcec352..cfa90755 100644
--- a/openpgp/src/cert/bindings.rs
+++ b/openpgp/src/cert/bindings.rs
@@ -31,7 +31,7 @@ impl<P: key::KeyParts> Key<P, key::SubordinateRole> {
     /// # fn f() -> Result<()> {
     /// // Generate a Cert, and create a keypair from the primary key.
     /// let (cert, _) = CertBuilder::new().generate()?;
-    /// let mut keypair = cert.primary().clone()
+    /// let mut keypair = cert.primary_key().clone()
     ///     .mark_parts_secret()?.into_keypair()?;
     ///
     /// // Let's add an encryption subkey.
@@ -64,7 +64,7 @@ impl<P: key::KeyParts> Key<P, key::SubordinateRole> {
         signature
             .set_issuer_fingerprint(signer.public().fingerprint())?
             .set_issuer(signer.public().keyid())?
-            .sign_subkey_binding(signer, cert.primary(), self)
+            .sign_subkey_binding(signer, cert.primary_key(), self)
     }
 }
 
@@ -92,7 +92,7 @@ impl UserID {
     /// # fn f() -> Result<()> {
     /// // Generate a Cert, and create a keypair from the primary key.
     /// let (cert, _) = CertBuilder::new().generate()?;
-    /// let mut keypair = cert.primary().clone()
+    /// let mut keypair = cert.primary_key().clone()
     ///     .mark_parts_secret()?.into_keypair()?;
     /// assert_eq!(cert.userids().len(), 0);
     ///
@@ -116,7 +116,7 @@ impl UserID {
             .set_issuer_fingerprint(signer.public().fingerprint())?
             .set_issuer(signer.public().keyid())?
             .sign_userid_binding(
-                signer, cert.primary(), self)
+                signer, cert.primary_key(), self)
     }
 
     /// Returns a certificate for the user id.
@@ -150,7 +150,7 @@ impl UserID {
     ///     .primary_key_flags(KeyFlags::default().set_certification(true))
     ///     .add_userid("alice@example.org")
     ///     .generate()?;
-    /// let mut keypair = alice.primary().clone()
+    /// let mut keypair = alice.primary_key().clone()
     ///     .mark_parts_secret()?.into_keypair()?;
     ///
     /// // Generate a Cert for Bob.
@@ -227,7 +227,7 @@ impl UserAttribute {
     /// // Generate a Cert, and create a keypair from the primary key.
     /// let (cert, _) = CertBuilder::new()
     ///     .generate()?;
-    /// let mut keypair = cert.primary().clone()
+    /// let mut keypair = cert.primary_key().clone()
     ///     .mark_parts_secret()?.into_keypair()?;
     /// assert_eq!(cert.userids().len(), 0);
     ///
@@ -253,7 +253,7 @@ impl UserAttribute {
         signature
             .set_issuer_fingerprint(signer.public().fingerprint())?
             .set_issuer(signer.public().keyid())?
-            .sign_user_attribute_binding(signer, cert.primary(), self)
+            .sign_user_attribute_binding(signer, cert.primary_key(), self)
     }
 
     /// Returns a certificate for the user attribute.
@@ -287,7 +287,7 @@ impl UserAttribute {
     /// let (alice, _) = CertBuilder::new()
     ///     .add_userid("alice@example.org")
     ///     .generate()?;
-    /// let mut keypair = alice.primary().clone()
+    /// let mut keypair = alice.primary_key().clone()
     ///     .mark_parts_secret()?.into_keypair()?;
     ///
     /// // Generate a Cert for Bob.
diff --git a/openpgp/src/cert/builder.rs b/openpgp/src/cert/builder.rs
index a9664256..add4d660 100644
--- a/openpgp/src/cert/builder.rs
+++ b/openpgp/src/cert/builder.rs
@@ -513,14 +513,14 @@ mod tests {
             .set_cipher_suite(CipherSuite::RSA3k)
             .set_cipher_suite(CipherSuite::Cv25519)
             .generate().unwrap();
-        assert_eq!(cert1.primary().pk_algo(), PublicKeyAlgorithm::EdDSA);
+        assert_eq!(cert1.primary_key().pk_algo(), PublicKeyAlgorithm::EdDSA);
 
         let (cert2, _) = CertBuilder::new()
             .set_cipher_suite(CipherSuite::RSA3k)
             .add_userid("test2@example.com")
             .add_transport_encryption_subkey()
             .generate().unwrap();
-        assert_eq!(cert2.primary().pk_algo(),
+        assert_eq!(cert2.primary_key().pk_algo(),
                    PublicKeyAlgorithm::RSAEncryptSign);
         assert_eq!(cert2.subkeys().next().unwrap().key().pk_algo(),
                    PublicKeyAlgorithm::RSAEncryptSign);
@@ -531,7 +531,7 @@ mod tests {
         let (cert1, _) = CertBuilder::new()
             .add_userid("test2@example.com")
             .generate().unwrap();
-        assert_eq!(cert1.primary().pk_algo(),
+        assert_eq!(cert1.primary_key().pk_algo(),
                    PublicKeyAlgorithm::EdDSA);
         assert!(cert1.subkeys().next().is_none());
         if let Some(sig) = cert1.primary_key_signature(None) {
@@ -546,7 +546,7 @@ mod tests {
         let (cert1, _) = CertBuilder::autocrypt(Autocrypt::V1,
                                               Some("Foo"))
             .generate().unwrap();
-        assert_eq!(cert1.primary().pk_algo(),
+        assert_eq!(cert1.primary_key().pk_algo(),
                    PublicKeyAlgorithm::RSAEncryptSign);
         assert_eq!(cert1.subkeys().next().unwrap().key().pk_algo(),
                    PublicKeyAlgorithm::RSAEncryptSign);
@@ -558,7 +558,7 @@ mod tests {
         let (cert1, _) = CertBuilder::autocrypt(Autocrypt::V1_1,
                                               Some("Foo"))
             .generate().unwrap();
-        assert_eq!(cert1.primary().pk_algo(),
+        assert_eq!(cert1.primary_key().pk_algo(),
                    PublicKeyAlgorithm::EdDSA);
         assert_eq!(cert1.subkeys().next().unwrap().key().pk_algo(),
                    PublicKeyAlgorithm::ECDH);
@@ -638,7 +638,7 @@ mod tests {
             .set_cipher_suite(CipherSuite::Cv25519)
             .set_password(Some(String::from("streng geheim").into()))
             .generate().unwrap();
-        assert!(cert.primary().secret().unwrap().is_encrypted());
+        assert!(cert.primary_key().secret().unwrap().is_encrypted());
     }
 
     #[test]
@@ -663,9 +663,9 @@ mod tests {
                         None)
             .generate().unwrap();
 
-        let now = cert.primary().creation_time()
+        let now = cert.primary_key().creation_time()
             + 5 * s; // The subkeys may be created a tad later.
-        let key = cert.primary();
+        let key = cert.primary_key();
         let sig = cert.primary_key_signature(None).unwrap();
         assert!(sig.key_alive(key, now).is_ok());
         assert!(sig.key_alive(key, now + 590 * s).is_ok());
@@ -696,7 +696,7 @@ mod tests {
             .add_signing_subkey()
             .generate().unwrap();
 
-        assert_eq!(cert.primary().creation_time(), UNIX_EPOCH);
+        assert_eq!(cert.primary_key().creation_time(), UNIX_EPOCH);
         assert_eq!(cert.primary_key_signature(None).unwrap()
                    .signature_creation_time().unwrap(), UNIX_EPOCH);
         assert_eq!(rev.signature_creation_time().unwrap(), UNIX_EPOCH);
diff --git a/openpgp/src/cert/mod.rs b/openpgp/src/cert/mod.rs
index 6a57f077..6ba0c615 100644
--- a/openpgp/src/cert/mod.rs
+++ b/openpgp/src/cert/mod.rs
@@ -105,7 +105,7 @@ fn sig_cmp(a: &Signature, b: &Signature) -> Ordering {
 
 impl fmt::Display for Cert {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        write!(f, "{}", self.primary().fingerprint())
+        write!(f, "{}", self.fingerprint())
     }
 }
 
@@ -282,7 +282,7 @@ type UnknownBindings = ComponentBindings<Unknown>;
 ///     let mut acc = Vec::new();
 ///
 ///     // Primary key and related signatures.
-///     acc.push(cert.primary().clone().into());
+///     acc.push(cert.primary_key().clone().into());
 ///     for s in cert.direct_signatures()  { acc.push(s.clone().into()) }
 ///     for s in cert.certifications()     { acc.push(s.clone().into()) }
 ///     for s in cert.self_revocations()   { acc.push(s.clone().into()) }
@@ -352,7 +352,7 @@ type UnknownBindings = ComponentBindings<Unknown>;
 /// #     let ppr = PacketParser::from_bytes(&b""[..])?;
 /// match Cert::from_packet_parser(ppr) {
 ///     Ok(cert) => {
-///         println!("Key: {}", cert.primary());
+///         println!("Key: {}", cert.primary_key());
 ///         for binding in cert.userids().bindings() {
 ///             println!("User ID: {}", binding.userid());
 ///         }
@@ -408,15 +408,9 @@ impl<'a> Parse<'a, Cert> for Cert {
 }
 
 impl Cert {
-    /// Returns a reference to the primary key binding.
-    ///
-    /// Note: information about the primary key is often stored on the
-    /// primary User ID's self signature.  Since these signatures are
-    /// associated with the UserID and not the primary key, that
-    /// information is not contained in the key binding.  Instead, you
-    /// should use methods like `Cert::primary_key_signature()` to get
-    /// information about the primary key.
-    pub fn primary(&self) -> &key::PublicKey {
+    /// Returns the primary key at time `time`
+    pub fn primary_key(&self) -> &key::PublicKey
+    {
         &self.primary.key()
     }
 
@@ -567,7 +561,7 @@ impl Cert {
     /// assert_eq!(RevocationStatus::NotAsFarAsWeKnow,
     ///            cert.revoked(None));
     ///
-    /// let mut keypair = cert.primary().clone()
+    /// let mut keypair = cert.primary_key().clone()
     ///     .mark_parts_secret()?.into_keypair()?;
     /// let cert = cert.revoke_in_place(&mut keypair,
     ///                               ReasonForRevocation::KeyCompromised,
@@ -600,7 +594,7 @@ impl Cert {
     {
         let t = t.into();
         if let Some(sig) = self.primary_key_signature(t) {
-            sig.key_alive(self.primary(), t)
+            sig.key_alive(self.primary_key(), t)
         } else {
             Err(Error::MalformedCert("No primary key signature".into()).into())
         }
@@ -627,7 +621,7 @@ impl Cert {
             let hash_algo = HashAlgorithm::SHA512;
             let mut hash = hash_algo.context()?;
 
-            self.primary().hash(&mut hash);
+            self.primary_key().hash(&mut hash);
             if let Some((userid, _)) = userid {
                 userid.userid().hash(&mut hash);
             } else {
@@ -1149,7 +1143,7 @@ impl Cert {
 
         if self.bad.len() > 0 {
             t!("{}: ignoring {} bad self-signatures",
-               self.primary().keyid(), self.bad.len());
+               self.primary_key().keyid(), self.bad.len());
         }
 
         // Only keep user ids / user attributes / subkeys with at
@@ -1223,12 +1217,12 @@ impl Cert {
 
     /// Returns the Cert's fingerprint.
     pub fn fingerprint(&self) -> Fingerprint {
-        self.primary().fingerprint()
+        self.primary_key().fingerprint()
     }
 
     /// Returns the Cert's keyid.
     pub fn keyid(&self) -> KeyID {
-        self.primary().keyid()
+        self.primary_key().keyid()
     }
 
     /// Converts the Cert into an iterator over a sequence of packets.
@@ -1252,8 +1246,7 @@ impl Cert {
     ///
     /// If `other` is a different key, then an error is returned.
     pub fn merge(mut self, mut other: Cert) -> Result<Self> {
-        if self.primary().fingerprint()
-            != other.primary().fingerprint()
+        if self.fingerprint() != other.fingerprint()
         {
             // The primary key is not the same.  There is nothing to
             // do.
@@ -1335,7 +1328,7 @@ impl Cert {
     /// Returns whether at least one of the keys includes a secret
     /// part.
     pub fn is_tsk(&self) -> bool {
-        if self.primary().secret().is_some() {
+        if self.primary_key().secret().is_some() {
             return true;
         }
         self.subkeys().any(|sk| {
@@ -1825,14 +1818,14 @@ mod test {
         let cert = Cert::from_bytes(crate::tests::key("about-to-expire.expired.pgp"))
             .unwrap();
         assert!(! cert.primary_key_signature(None).unwrap()
-                .key_alive(cert.primary(), None).is_ok());
+                .key_alive(cert.primary_key(), None).is_ok());
 
         let update =
             Cert::from_bytes(crate::tests::key("about-to-expire.update-no-uid.pgp"))
             .unwrap();
         let cert = cert.merge(update).unwrap();
         assert!(cert.primary_key_signature(None).unwrap()
-                .key_alive(cert.primary(), None).is_ok());
+                .key_alive(cert.primary_key(), None).is_ok());
     }
 
     #[test]
@@ -1892,14 +1885,14 @@ mod test {
         let (cert, _) = CertBuilder::autocrypt(None, Some("Test"))
             .generate().unwrap();
 
-        let now = cert.primary().creation_time();
+        let now = cert.primary_key().creation_time();
         let a_sec = time::Duration::new(1, 0);
 
         let expiry_orig = cert.primary_key_signature(None).unwrap()
             .key_expiration_time()
             .expect("Keys expire by default.");
 
-        let mut keypair = cert.primary().clone().mark_parts_secret()
+        let mut keypair = cert.primary_key().clone().mark_parts_secret()
             .unwrap().into_keypair().unwrap();
 
         // Clear the expiration.
@@ -2072,7 +2065,7 @@ mod test {
         assert_eq!(RevocationStatus::NotAsFarAsWeKnow,
                    cert.revoked(None));
 
-        let mut keypair = cert.primary().clone().mark_parts_secret()
+        let mut keypair = cert.primary_key().clone().mark_parts_secret()
             .unwrap().into_keypair().unwrap();
 
         let sig = CertRevocationBuilder::new()
@@ -2082,9 +2075,9 @@ mod test {
             .build(&mut keypair, &cert, None)
             .unwrap();
         assert_eq!(sig.typ(), SignatureType::KeyRevocation);
-        assert_eq!(sig.issuer(), Some(&cert.primary().keyid()));
+        assert_eq!(sig.issuer(), Some(&cert.primary_key().keyid()));
         assert_eq!(sig.issuer_fingerprint(),
-                   Some(&cert.primary().fingerprint()));
+                   Some(&cert.fingerprint()));
 
         let cert = cert.merge_packets(vec![sig.into()]).unwrap();
         assert_match!(RevocationStatus::Revoked(_) = cert.revoked(None));
@@ -2094,7 +2087,7 @@ mod test {
         let (other, _) = CertBuilder::autocrypt(None, Some("Test 2"))
             .generate().unwrap();
 
-        let mut keypair = other.primary().clone().mark_parts_secret()
+        let mut keypair = other.primary_key().clone().mark_parts_secret()
             .unwrap().into_keypair().unwrap();
 
         let sig = CertRevocationBuilder::new()
@@ -2105,9 +2098,9 @@ mod test {
             .unwrap();
 
         assert_eq!(sig.typ(), SignatureType::KeyRevocation);
-        assert_eq!(sig.issuer(), Some(&other.primary().keyid()));
+        assert_eq!(sig.issuer(), Some(&other.keyid()));
         assert_eq!(sig.issuer_fingerprint(),
-                   Some(&other.primary().fingerprint()));
+                   Some(&other.fingerprint()));
     }
 
     #[test]
@@ -2120,7 +2113,7 @@ mod test {
             let subkey = cert.subkeys().nth(0).unwrap();
             assert_eq!(RevocationStatus::NotAsFarAsWeKnow, subkey.revoked(None));
 
-            let mut keypair = cert.primary().clone().mark_parts_secret()
+            let mut keypair = cert.primary_key().clone().mark_parts_secret()
                 .unwrap().into_keypair().unwrap();
             SubkeyRevocationBuilder::new()
                 .set_reason_for_revocation(
@@ -2149,7 +2142,7 @@ mod test {
             let uid = cert.userids().policy(None).nth(1).unwrap();
             assert_eq!(RevocationStatus::NotAsFarAsWeKnow, uid.revoked());
 
-            let mut keypair = cert.primary().clone().mark_parts_secret()
+            let mut keypair = cert.primary_key().clone().mark_parts_secret()
                 .unwrap().into_keypair().unwrap();
             UserIDRevocationBuilder::new()
                 .set_reason_for_revocation(
@@ -2892,7 +2885,7 @@ Pu1xwz57O4zo1VYf6TqHJzVC3OMvMUM2hhdecMUe5x6GorNaj6g=
             // Have alice cerify the binding "bob@bar.com" and bob's key.
             let alice_certifies_bob
                 = bob_userid_binding.userid().bind(
-                    &mut alice.primary().clone().mark_parts_secret()
+                    &mut alice.primary_key().clone().mark_parts_secret()
                         .unwrap().into_keypair().unwrap(),
                     &bob,
                     sig_template).unwrap();
@@ -2918,8 +2911,8 @@ Pu1xwz57O4zo1VYf6TqHJzVC3OMvMUM2hhdecMUe5x6GorNaj6g=
 
             // Make sure the certification is correct.
             alice_certifies_bob
-                .verify_userid_binding(&alice.primary().clone(),
-                                       &bob.primary().clone(),
+                .verify_userid_binding(&alice.primary_key().clone(),
+                                       &bob.primary_key().clone(),
                                        bob_userid_binding.userid()).unwrap();
         }
    }
@@ -2933,7 +2926,7 @@ Pu1xwz57O4zo1VYf6TqHJzVC3OMvMUM2hhdecMUe5x6GorNaj6g=
         assert_eq!(cert.keys().secret().count(), 2);
         assert_eq!(cert.keys().unencrypted_secret().count(), 0);
 
-        let mut primary = cert.primary().clone();
+        let mut primary = cert.primary_key().clone();
         let algo = primary.pk_algo();
         primary.secret_mut().unwrap()
             .decrypt_in_place(algo, &"streng geheim".into()).unwrap();
diff --git a/openpgp/src/cert/parser/mod.rs b/openpgp/src/cert/parser/mod.rs
index 3f509310..df558e23 100644
--- a/openpgp/src/cert/parser/mod.rs
+++ b/openpgp/src/cert/parser/mod.rs
@@ -401,7 +401,7 @@ enum PacketSource<'a, I: Iterator<Item=Packet>> {
 /// for certo in CertParser::from_packet_parser(ppr) {
 ///     match certo {
 ///         Ok(cert) => {
-///             println!("Key: {}", cert.primary());
+///             println!("Key: {}", cert.primary_key());
 ///             for uid in cert.userids() {
 ///                 println!("User ID: {}", uid);
 ///             }
@@ -661,7 +661,7 @@ impl<'a, I: Iterator<Item=Packet>> CertParser<'a, I> {
                 b.other_revocations = other_revs;
             }
 
-            let primary_fp: KeyHandle = cert.primary().fingerprint().into();
+            let primary_fp: KeyHandle = cert.key_handle();
             let primary_keyid = KeyHandle::KeyID(primary_fp.clone().into());
 
             // The parser puts all of the signatures on the
@@ -757,7 +757,7 @@ impl<'a, I: Iterator<Item=Packet>> Iterator for CertParser<'a, I> {
                         Ok(Some(cert)) => {
                             if TRACE {
                                 eprintln!("CertParser::next => {}",
-                                          cert.primary().fingerprint());
+                                          cert.fingerprint());
                             }
                             return Some(Ok(cert));
                         }
diff --git a/openpgp/src/cert/revoke.rs b/openpgp/src/cert/revoke.rs
index 55aa9c31..6b8e2b28 100644
--- a/openpgp/src/cert/revoke.rs
+++ b/openpgp/src/cert/revoke.rs
@@ -54,7 +54,7 @@ use crate::cert::Cert;
 /// assert_eq!(RevocationStatus::NotAsFarAsWeKnow,
 ///            cert.revoked(None));
 ///
-/// let mut signer = cert.primary().clone()
+/// let mut signer = cert.primary_key().clone()
 ///     .mark_parts_secret()?.into_keypair()?;
 /// let sig = CertRevocationBuilder::new()
 ///     .set_reason_for_revocation(ReasonForRevocation::KeyCompromised,
@@ -108,7 +108,7 @@ impl CertRevocationBuilder {
         let hash_algo = hash_algo.into().unwrap_or(HashAlgorithm::SHA512);
         let mut hash = hash_algo.context()?;
 
-        cert.primary().hash(&mut hash);
+        cert.primary_key().hash(&mut hash);
 
         let creation_time
             = self.signature_creation_time()
@@ -161,7 +161,7 @@ impl Deref for CertRevocationBuilder {
 /// let (cert, _) = CertBuilder::new()
 ///     .add_transport_encryption_subkey()
 ///     .generate()?;
-/// let mut keypair = cert.primary().clone()
+/// let mut keypair = cert.primary_key().clone()
 ///     .mark_parts_secret()?.into_keypair()?;
 /// let subkey = cert.keys().subkeys().nth(0).unwrap();
 ///
@@ -274,7 +274,7 @@ impl Deref for SubkeyRevocationBuilder {
 /// let (cert, _) = CertBuilder::new()
 ///     .add_userid("some@example.org")
 ///     .generate()?;
-/// let mut keypair = cert.primary().clone()
+/// let mut keypair = cert.primary_key().clone()
 ///     .mark_parts_secret()?.into_keypair()?;
 /// let userid = cert.userids().nth(0).unwrap();
 ///
@@ -389,7 +389,7 @@ impl Deref for UserIDRevocationBuilder {
 /// let (cert, _) = CertBuilder::new()
 ///     .add_user_attribute(some_user_attribute)
 ///     .generate()?;
-/// let mut keypair = cert.primary().clone()
+/// let mut keypair = cert.primary_key().clone()
 ///     .mark_parts_secret()?.into_keypair()?;
 /// let ua = cert.user_attributes().nth(0).unwrap();
 ///
diff --git a/openpgp/src/crypto/hash.rs b/openpgp/src/crypto/hash.rs
index 9d2ff7d2..4afe0f89 100644
--- a/openpgp/src/crypto/hash.rs
+++ b/openpgp/src/crypto/hash.rs
@@ -495,7 +495,7 @@ mod test {
                 for selfsig in binding.self_signatures() {
                     let h = Signature::hash_userid_binding(
                         selfsig,
-                        cert.primary(),
+                        cert.primary_key(),
                         binding.userid()).unwrap();
                     if &h[..2] != selfsig.digest_prefix() {
                         eprintln!("{:?}: {:?} / {:?}",
@@ -512,7 +512,7 @@ mod test {
                 for selfsig in binding.self_signatures() {
                     let h = Signature::hash_user_attribute_binding(
                         selfsig,
-                        cert.primary(),
+                        cert.primary_key(),
                         binding.user_attribute()).unwrap();
                     if &h[..2] != selfsig.digest_prefix() {
                         eprintln!("{:?}: {:?} / {:?}",
@@ -528,7 +528,7 @@ mod test {
                 for selfsig in binding.self_signatures() {
                     let h = Signature::hash_subkey_binding(
                         selfsig,
-                        cert.primary(),
+                        cert.primary_key(),
                         binding.key()).unwrap();
                     if &h[..2] != selfsig.digest_prefix() {
                         eprintln!("{:?}: {:?}", i, binding);
diff --git a/openpgp/src/packet/key/mod.rs b/openpgp/src/packet/key/mod.rs
index 24523d6f..3e709873 100644
--- a/openpgp/src/packet/key/mod.rs
+++ b/openpgp/src/packet/key/mod.rs
@@ -43,10 +43,10 @@
 //! // Get a handle to the Cert's primary key that allows using the
 //! // secret key material.
 //! use std::convert::TryInto;
-//! let sk: &Key<key::SecretParts, key::PrimaryRole> = cert.primary().try_into()?;
+//! let sk: &Key<key::SecretParts, key::PrimaryRole> = cert.primary_key().try_into()?;
 //!
 //! // Make the conversion explicit.
-//! let sk = cert.primary().mark_parts_secret_ref()?;
+//! let sk = cert.primary_key().mark_parts_secret_ref()?;
 //! #     Ok(())
 //! # }
 //! ```
@@ -1328,7 +1328,7 @@ mod tests {
     fn encrypted_rsa_key() {
         let cert = Cert::from_bytes(
             crate::tests::key("testy-new-encrypted-with-123.pgp")).unwrap();
-        let mut pair = cert.primary().clone();
+        let mut pair = cert.primary_key().clone();
         let pk_algo = pair.pk_algo();
         let secret = pair.secret.as_mut().unwrap();
 
diff --git a/openpgp/src/packet/si