Am I reading correctly that ~“GPG private keys were stored unencrypted” and ~“messages could be modified to include non-encrypted chunks, which the client displayed without indicating the distinction” both count as low-severity?