Simon has resolved the SHA1 licence upstream[1] by clarifying that the GnuPG code was originally available under GPLv2+. [1] https://github.com/chocolate-doom/chocolate-doom/commit/4ffeb43fb33f5899f1aaf2b4bae484d2a3d71211