A refusal you asked to be remembered now holds even while automatic approval is switched on, and a permission you set to ask now asks instead of being approved for you. Both were being overridden by the automatic setting before. An app whose access window has run out has to be approved again rather than quietly falling back to your default setting, and its permission to sign in the background is withdrawn. A refusal is kept for as long as you set it.

The co-signing prompt now shows which request is asking to sign, and marks that label as unverified when nothing has proven it. Random number generation that cannot reach a trusted source now stops the operation instead of continuing with a weaker one. A legacy key share is erased only after a copy is confirmed stored. Stored values are bound to the key they were saved under, so they cannot be read back under a different key.

The co-signing prompt now shows which request is asking to sign, and marks that label as unverified when nothing has proven it. Random number generation that cannot reach a trusted source now stops the operation instead of continuing with a weaker one. A legacy key share is erased only after a copy is confirmed stored. Stored values are bound to the key they were saved under, so they cannot be read back under a different key.

Signing history entries can no longer be recorded with a time earlier than the entry before them, so a clock correction or a changed device clock cannot make one approval appear to precede another. Restoring a backup now keeps each share's recorded backed-up state instead of marking everything backed up, so the reminder to back up a share still appears when it should.