This page says:
self-signatures must not use SHA1
You can check this by doing:
gpg --export-options export-minimal --export <keyid> | gpg --list-packets |grep -A 2 signature|grep 'digest algo 2,'
If you see any ‘digest algo 2’ results printed, then you have some self-signatures that are using SHA1, as digest algo 2 is SHA1. See the OpenPGP RFC 4880, section 9.4 for a table that maps hash algorithms to numbers.
I set up a key following best practice instructions (Debian's developer keysigning guidelines), but I get
digest algo 2 lines printed when I run this. What exactly does this mean, and what part of setting up the key affects this?