diff -Nru thunderbird-91.9.0+build2/BUILDID thunderbird-91.9.0+build3/BUILDID
--- thunderbird-91.9.0+build2/BUILDID	2022-05-02 05:35:19.000000000 +0000
+++ thunderbird-91.9.0+build3/BUILDID	2022-05-02 21:13:50.000000000 +0000
@@ -1 +1 @@
-20220429123028
\ No newline at end of file
+20220502180952
\ No newline at end of file
diff -Nru thunderbird-91.9.0+build2/comm/mail/locales/en-US/messenger/openpgp/openpgp.ftl thunderbird-91.9.0+build3/comm/mail/locales/en-US/messenger/openpgp/openpgp.ftl
--- thunderbird-91.9.0+build2/comm/mail/locales/en-US/messenger/openpgp/openpgp.ftl	2022-05-02 05:26:03.000000000 +0000
+++ thunderbird-91.9.0+build3/comm/mail/locales/en-US/messenger/openpgp/openpgp.ftl	2022-05-02 21:05:01.000000000 +0000
@@ -246,7 +246,7 @@
 openpgp-key-details-key-type-label = Type
 openpgp-key-details-key-part-label =
     .label = Key Part
-openpgp-key-details-attr-ignored = Warning: This key might not work as expected, because some of its properties are unsafe and are therefore ignored.
+openpgp-key-details-attr-ignored = Warning: This key might not work as expected, because some of its properties are unsafe and might be ignored.
 openpgp-key-details-algorithm-label =
     .label = Algorithm
 openpgp-key-details-size-label =
diff -Nru thunderbird-91.9.0+build2/comm/mail/themes/windows/mail/messenger.css thunderbird-91.9.0+build3/comm/mail/themes/windows/mail/messenger.css
--- thunderbird-91.9.0+build2/comm/mail/themes/windows/mail/messenger.css	2022-05-02 05:26:03.000000000 +0000
+++ thunderbird-91.9.0+build3/comm/mail/themes/windows/mail/messenger.css	2022-05-02 21:05:01.000000000 +0000
@@ -66,7 +66,7 @@
     --tabs-border-color: ThreeDShadow;
     --tabline-color: Highlight;
     --item-focus-selected-border-color: HighlightText;
-    --new-folder-color: Highligt;
+    --new-folder-color: Highlight;
     --menuitem-vertical-padding: 3px;
     --arrowpanel-dimmed: Highlight;
     --arrowpanel-dimmed-further: Highlight;
diff -Nru thunderbird-91.9.0+build2/comm/SOURCE_CHANGESET thunderbird-91.9.0+build3/comm/SOURCE_CHANGESET
--- thunderbird-91.9.0+build2/comm/SOURCE_CHANGESET	2022-05-02 05:26:21.000000000 +0000
+++ thunderbird-91.9.0+build3/comm/SOURCE_CHANGESET	2022-05-02 21:05:18.000000000 +0000
@@ -1 +1 @@
-a70417df307f2a62db0b80a316053d784bcfdfb9
\ No newline at end of file
+8b44d29de6525d6379f163f50c1a900d4540ef1b
\ No newline at end of file
diff -Nru thunderbird-91.9.0+build2/comm/third_party/rnp/src/lib/crypto/signatures.cpp thunderbird-91.9.0+build3/comm/third_party/rnp/src/lib/crypto/signatures.cpp
--- thunderbird-91.9.0+build2/comm/third_party/rnp/src/lib/crypto/signatures.cpp	2022-05-02 05:26:04.000000000 +0000
+++ thunderbird-91.9.0+build3/comm/third_party/rnp/src/lib/crypto/signatures.cpp	2022-05-02 21:05:02.000000000 +0000
@@ -263,10 +263,40 @@
         return RNP_ERROR_BAD_PARAMETERS;
     }
 
-    /* Check signature security */
-    if (ctx.profile.hash_level(sig.halg, sig.creation()) < rnp::SecurityLevel::Default) {
-        RNP_LOG("Insecure hash algorithm %d, marking signature as invalid.", sig.halg);
-        return RNP_ERROR_SIGNATURE_INVALID;
+    bool check_security_level = true;
+    if (hash.alg() == PGP_HASH_SHA1) {
+      /* Check signature security */
+      switch (sig.type()) {
+          /* key certifications */
+          case PGP_CERT_GENERIC:
+          case PGP_CERT_PERSONA:
+          case PGP_CERT_CASUAL:
+          case PGP_CERT_POSITIVE:
+          /* subkey binding signature */
+          case PGP_SIG_SUBKEY:
+          case PGP_SIG_PRIMARY:
+          /* direct-key signature */
+          case PGP_SIG_DIRECT:
+          /* revocation signatures */
+          case PGP_SIG_REV_KEY:
+          case PGP_SIG_REV_SUBKEY:
+          case PGP_SIG_REV_CERT:
+              /* Allow */
+              check_security_level = false;
+              break;
+
+          default:
+              break;
+      }
+    }
+
+    if (check_security_level) {
+      /* Only allow if the additional check passes. */
+      if (ctx.profile.hash_level(sig.halg, sig.creation()) < rnp::SecurityLevel::Default) {
+          RNP_LOG("Insecure hash algorithm %d, marking signature as invalid.", sig.halg);
+          return RNP_ERROR_SIGNATURE_INVALID;
+
+      }
     }
 
     /* Finalize hash */
diff -Nru thunderbird-91.9.0+build2/debian/changelog thunderbird-91.9.0+build3/debian/changelog
--- thunderbird-91.9.0+build2/debian/changelog	2022-05-02 07:22:35.000000000 +0000
+++ thunderbird-91.9.0+build3/debian/changelog	2022-05-04 09:18:30.000000000 +0000
@@ -1,3 +1,9 @@
+thunderbird (1:91.9.0+build3-0ubuntu0.21.10.1) impish; urgency=medium
+
+  * New upstream stable release (91.9.0build3)
+
+ -- Olivier Tilloy <olivier.tilloy@canonical.com>  Wed, 04 May 2022 11:18:30 +0200
+
 thunderbird (1:91.9.0+build2-0ubuntu0.21.10.1) impish; urgency=medium
 
   * New upstream stable release (91.9.0build2)