Flaw found in PGP code