web UI: Prove you have the private key / command line with [ bash + gpg + cURL] fails

I get:

`Error in your post`
`-------------------`
`
Code: 905
Name: KEY_CORRUPTED
Description: no valid primary key self-signature or key(s) have expired (Signature failure in packet 1: rejecting insecure hash SHA1 (b09b16faed079011))`

The `echo {json} | gpg -u $keyid -a --sign` command generates a message with a correct signature:

`gpg: Signature made Mo 29 Mar 12:36:45 2021 CEST
gpg: using RSA key 0EBFBCCA3E540AD481817E16B09B16FAED079011
gpg: Good signature from "Christoph Badura " [ultimate]`

what gives?

Start by reproducing the reported `echo {json} | gpg -u $keyid -a --sign` command and compare its local verification output with the server's `KEY_CORRUPTED` response. Trace the command-line signing request in the Keybase client or website entry point; done means the reported valid signature is accepted, or the incompatibility is clearly documented.

Written by the indexing model from the issue text.