# What is a nested signature in GPG and how to decrypt it in OpenPGP?

When I decrypt a file in OpenPGP (in Golang), I receive this error message:

unsupported feature: nested signatures


In RFC 4880, under One-Pass Signature Packets, it says that:

The body of this packet consists of:

• A one-octet version number. The current version is 3.
• A one-octet signature type. Signature types are described in Section 5.2.1.
• A one-octet number describing the hash algorithm used.

• A one-octet number describing the public-key algorithm used.

• An eight-octet number holding the Key ID of the signing key.
• A one-octet number holding a flag showing whether the signature is nested. A zero value indicates that the next packet is another One-Pass Signature packet that describes another signature to be applied to the same message data.

Note that if a message contains more than one one-pass signature,
then the Signature packets bracket the message; that is, the first
Signature packet after the message corresponds to the last one-pass
packet and the final Signature packet corresponds to the first
one-pass packet.

However, I simply can't understand what "bracket the message" means. Could someone explain it more clearly? Thanks.

• This Q/A site is about cryptographic uses only. I'll not close the question as it is basically about understanding the protocol / nested signatures. However, "how to decrypt it in openPGP" is a tooling related question and therefore strictly optional in any answer (besides that, the error message is pretty clear I think, and just looking at the bug database for feature requests seems more productive). – Maarten Bodewes Aug 13 at 14:49