Please don't open a public issue. Use Report a vulnerability instead, so the problem can be fixed before it is public.

Include what you sent (the request, with the keys removed), what happened, the version of the crate, and whether it is the client, the server or the signing code.

Fixes are released for the newest version only.