fips-mode-setup: Write error messages to stderr
fips-mode-setup: Fix some shellcheck warnings
fips-mode-setup: Fix test for empty /boot
fips-mode-setup: Avoid 'boot=UUID=' if /boot == /

Restore support for scoped ssh_etm directives
Print matches in syntax deprecation warnings

fips-mode-setup: Fix usage with --no-bootcfg

turn ssh_etm into an etm@SSH tri-state
fips-mode-setup: increase chroot-friendliness (rhbz#2164847)

OSPP subpolicy: tighten beyond reason for OSPP 4.3
fips-mode-setup: more thorough --disable, still unsupported

BSI: start a BSI TR 02102 policy
krb5: sort enctypes mac-first, cipher-second, prioritize SHA-2 ones
FIPS: enforce EMS in FIPS mode
NO-ENFORCE-EMS: add subpolicy to undo the EMS enforcement in FIPS mode
nss: implement EMS enforcement in FIPS mode (not enabled yet)
openssl: implement EMS enforcement in FIPS mode
gnutls: implement EMS enforcement in FIPS mode (not enabled yet)
docs: replace `FIPS 140-2` with just `FIPS 140`

Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

policies: restore group order to old OpenSSL default order

openssl: specify Groups explicitly
openssl: add support for Brainpool curves

rpm-sequoia: add separate rpm-sequoia backend
DEFAULT: allow SHA-1 and 1024 bit DSA in RPM (https://pagure.io/fesco/issue/2960)

Makefile: support asciidoc 10

Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

bind: expand the list of disableable algorithms

sequoia: introduce new backend
migrate license tag to SPDX

openssh: force RequiredRSASize option name

revert premature Fedora 38 Rawhide SHA-1 "jump scare" until