We have included code originating from OpenKeychains. Our current
downstreams should all be okay with GPLv3. If not, contact me and we
might be able to figure something out (e.g. isolating GPLv3 code)