I think I was too quick with this report (I was shocked, sorry). xca apparently exports the public certificate instead of the certificate request. But NOT the private certificate.
Still a bug, but certainly not important. Sorry for the wrong alert. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org