I am trying to manually create a GPG Public Key (see here). I am able to generate a GPG Public Key with a correct hash, but fail to RSA-sign that hash in a way that is accepted by the GPG CLI. For the GPG Public Key I have created see here.
To sign the hash I am using a private key on a PKCS#11 HSM. The HSM supports various signing mechanisms. I have tried signing with RSA-PKCS-PSS (with hash algorithm SHA512 and mask generation function MGF1-SHA512), SHA512-RSA-PKCS, and SHA512-RSA-PKCS-PSS, but neither produces a signature that the import command of the GPG CLI accepts. I suppose the GPG CLI expects a different padding.
Unfortunately, RFC 4880 does not explicitely cover GPG Public Key signature padding, but only specifies that EME-PKCS1-v1_5 and EMSA-PKCS1-v1_5 functions are used for PKCS#1 encoding. A quick search through the GPG source code shows that both PKCS#1 v1.5 and PSS are used at some points.
Does anybody know what padding exactly is supported in the import command of the GPG CLI?