The timeline mentioned:

  Disclosure Timeline:
  - 21.10.2025: Submission of initial version of this report.

  Upcoming Timeline:
  - 24.10.2025: Submission of a talk for 39th Chaos Communication Congress (39C3). No technical details shared.
  - 21.12.2025: Disclosure of this report on https://seclists.org/fulldisclosure/
  - 26-31.12.2025: If accepted by content team, 39C3 Congress talk regarding this report

I'm surprised to see that this isn't published on fulldisclosure yet, though there is a talk on GPG vulnerabilities scheduled for 39C3: https://fahrplan.events.ccc.de/congress/2025/fahrplan/event/... . 60 days from report to full disclosure is... tough.