pgpdecryptverify: fix non-onepass signature checking

OpenKeychain/src/main/java/org/sufficientlysecure/keychain/pgp/PgpDecryptVerifyOperation.java

@@ -963,6 +963,8 @@ public class PgpDecryptVerifyOperation extends BaseOperation<PgpDecryptVerifyInp
 
         log.add(LogType.MSG_DC_OK, indent);
 
+        // TODO return metadata object?
+
         DecryptVerifyResult result = new DecryptVerifyResult(DecryptVerifyResult.RESULT_OK, log);
         result.setSignatureResult(signatureChecker.getSignatureResult());
         result.setDecryptionResult(

OpenKeychain/src/main/java/org/sufficientlysecure/keychain/pgp/PgpSignatureChecker.java

@@ -203,7 +203,7 @@ class PgpSignatureChecker {
         }
 
         // check for insecure hash algorithms
-        if (!PgpSecurityConstants.isSecureHashAlgorithm(onePassSignature.getHashAlgorithm())) {
+        if (!PgpSecurityConstants.isSecureHashAlgorithm(signature.getHashAlgorithm())) {
             log.add(LogType.MSG_DC_INSECURE_HASH_ALGO, indent + 1);
             signatureResultBuilder.setInsecure(true);
         }