Apply final annotations to the library also

Done by a perl script which converted all classes to final, followed
by selective reversion where it caused compilation failures.

43 files changed, 64 insertions, 64 deletions

diff --git a/src/lib/pubkey/blinding.h b/src/lib/pubkey/blinding.h
index fc7cabe7a..1c3fb1444 100644
--- a/src/lib/pubkey/blinding.h
+++ b/src/lib/pubkey/blinding.h
@@ -19,7 +19,7 @@ class RandomNumberGenerator;
 /**
 * Blinding Function Object.
 */
-class BOTAN_PUBLIC_API(2,0) Blinder
+class BOTAN_PUBLIC_API(2,0) Blinder final
    {
    public:
       /**
diff --git a/src/lib/pubkey/cecpq1/cecpq1.h b/src/lib/pubkey/cecpq1/cecpq1.h
index 535cb49b7..a722899c6 100644
--- a/src/lib/pubkey/cecpq1/cecpq1.h
+++ b/src/lib/pubkey/cecpq1/cecpq1.h
@@ -13,7 +13,7 @@
 
 namespace Botan {
 
-class CECPQ1_key
+class CECPQ1_key final
    {
    public:
       secure_vector<uint8_t> m_x25519;
diff --git a/src/lib/pubkey/curve25519/curve25519.cpp b/src/lib/pubkey/curve25519/curve25519.cpp
index 7776c6550..2d07f67ab 100644
--- a/src/lib/pubkey/curve25519/curve25519.cpp
+++ b/src/lib/pubkey/curve25519/curve25519.cpp
@@ -112,7 +112,7 @@ namespace {
 /**
 * Curve25519 operation
 */
-class Curve25519_KA_Operation : public PK_Ops::Key_Agreement_with_KDF
+class Curve25519_KA_Operation final : public PK_Ops::Key_Agreement_with_KDF
    {
    public:
 
diff --git a/src/lib/pubkey/curve25519/curve25519.h b/src/lib/pubkey/curve25519/curve25519.h
index 9f2136a69..1e06fae67 100644
--- a/src/lib/pubkey/curve25519/curve25519.h
+++ b/src/lib/pubkey/curve25519/curve25519.h
@@ -55,7 +55,7 @@ class BOTAN_PUBLIC_API(2,0) Curve25519_PublicKey : public virtual Public_Key
       std::vector<uint8_t> m_public;
    };
 
-class BOTAN_PUBLIC_API(2,0) Curve25519_PrivateKey : public Curve25519_PublicKey,
+class BOTAN_PUBLIC_API(2,0) Curve25519_PrivateKey final : public Curve25519_PublicKey,
                                         public virtual Private_Key,
                                         public virtual PK_Key_Agreement_Key
    {
diff --git a/src/lib/pubkey/dh/dh.cpp b/src/lib/pubkey/dh/dh.cpp
index 25c5f5cf4..2a7742738 100644
--- a/src/lib/pubkey/dh/dh.cpp
+++ b/src/lib/pubkey/dh/dh.cpp
@@ -79,7 +79,7 @@ namespace {
 /**
 * DH operation
 */
-class DH_KA_Operation : public PK_Ops::Key_Agreement_with_KDF
+class DH_KA_Operation final : public PK_Ops::Key_Agreement_with_KDF
    {
    public:
 
diff --git a/src/lib/pubkey/dh/dh.h b/src/lib/pubkey/dh/dh.h
index a252f7a80..e3aa0d2c5 100644
--- a/src/lib/pubkey/dh/dh.h
+++ b/src/lib/pubkey/dh/dh.h
@@ -46,7 +46,7 @@ class BOTAN_PUBLIC_API(2,0) DH_PublicKey : public virtual DL_Scheme_PublicKey
 /**
 * This class represents Diffie-Hellman private keys.
 */
-class BOTAN_PUBLIC_API(2,0) DH_PrivateKey : public DH_PublicKey,
+class BOTAN_PUBLIC_API(2,0) DH_PrivateKey final : public DH_PublicKey,
                                 public PK_Key_Agreement_Key,
                                 public virtual DL_Scheme_PrivateKey
    {
diff --git a/src/lib/pubkey/dl_group/dl_group.h b/src/lib/pubkey/dl_group/dl_group.h
index 4ec9962d7..24b829bd9 100644
--- a/src/lib/pubkey/dl_group/dl_group.h
+++ b/src/lib/pubkey/dl_group/dl_group.h
@@ -16,7 +16,7 @@ namespace Botan {
 * This class represents discrete logarithm groups. It holds a prime p,
 * a prime q = (p-1)/2 and g = x^((p-1)/q) mod p.
 */
-class BOTAN_PUBLIC_API(2,0) DL_Group
+class BOTAN_PUBLIC_API(2,0) DL_Group final
    {
    public:
 
diff --git a/src/lib/pubkey/dlies/dlies.h b/src/lib/pubkey/dlies/dlies.h
index 471d29999..8fa673491 100644
--- a/src/lib/pubkey/dlies/dlies.h
+++ b/src/lib/pubkey/dlies/dlies.h
@@ -20,7 +20,7 @@ namespace Botan {
 /**
 * DLIES Encryption
 */
-class BOTAN_PUBLIC_API(2,0) DLIES_Encryptor : public PK_Encryptor
+class BOTAN_PUBLIC_API(2,0) DLIES_Encryptor final : public PK_Encryptor
    {
    public:
       /**
@@ -93,7 +93,7 @@ class BOTAN_PUBLIC_API(2,0) DLIES_Encryptor : public PK_Encryptor
 /**
 * DLIES Decryption
 */
-class BOTAN_PUBLIC_API(2,0) DLIES_Decryptor : public PK_Decryptor
+class BOTAN_PUBLIC_API(2,0) DLIES_Decryptor final : public PK_Decryptor
    {
    public:
       /**
diff --git a/src/lib/pubkey/dsa/dsa.cpp b/src/lib/pubkey/dsa/dsa.cpp
index 706722d72..532ede5d6 100644
--- a/src/lib/pubkey/dsa/dsa.cpp
+++ b/src/lib/pubkey/dsa/dsa.cpp
@@ -75,7 +75,7 @@ namespace {
 /**
 * Object that can create a DSA signature
 */
-class DSA_Signature_Operation : public PK_Ops::Signature_with_EMSA
+class DSA_Signature_Operation final : public PK_Ops::Signature_with_EMSA
    {
    public:
       DSA_Signature_Operation(const DSA_PrivateKey& dsa, const std::string& emsa) :
@@ -143,7 +143,7 @@ DSA_Signature_Operation::raw_sign(const uint8_t msg[], size_t msg_len,
 /**
 * Object that can verify a DSA signature
 */
-class DSA_Verification_Operation : public PK_Ops::Verification_with_EMSA
+class DSA_Verification_Operation final : public PK_Ops::Verification_with_EMSA
    {
    public:
       DSA_Verification_Operation(const DSA_PublicKey& dsa,
diff --git a/src/lib/pubkey/dsa/dsa.h b/src/lib/pubkey/dsa/dsa.h
index dc53d4801..b219a1cf3 100644
--- a/src/lib/pubkey/dsa/dsa.h
+++ b/src/lib/pubkey/dsa/dsa.h
@@ -52,7 +52,7 @@ class BOTAN_PUBLIC_API(2,0) DSA_PublicKey : public virtual DL_Scheme_PublicKey
 /**
 * DSA Private Key
 */
-class BOTAN_PUBLIC_API(2,0) DSA_PrivateKey : public DSA_PublicKey,
+class BOTAN_PUBLIC_API(2,0) DSA_PrivateKey final : public DSA_PublicKey,
                                  public virtual DL_Scheme_PrivateKey
    {
    public:
diff --git a/src/lib/pubkey/ec_group/ec_group.h b/src/lib/pubkey/ec_group/ec_group.h
index 028ec1b32..ccd69a4dc 100644
--- a/src/lib/pubkey/ec_group/ec_group.h
+++ b/src/lib/pubkey/ec_group/ec_group.h
@@ -28,7 +28,7 @@ enum EC_Group_Encoding {
 /**
 * Class representing an elliptic curve
 */
-class BOTAN_PUBLIC_API(2,0) EC_Group
+class BOTAN_PUBLIC_API(2,0) EC_Group final
    {
    public:
 
diff --git a/src/lib/pubkey/ecdh/ecdh.cpp b/src/lib/pubkey/ecdh/ecdh.cpp
index 799e8aac9..c05f22d1b 100644
--- a/src/lib/pubkey/ecdh/ecdh.cpp
+++ b/src/lib/pubkey/ecdh/ecdh.cpp
@@ -22,7 +22,7 @@ namespace {
 /**
 * ECDH operation
 */
-class ECDH_KA_Operation : public PK_Ops::Key_Agreement_with_KDF
+class ECDH_KA_Operation final : public PK_Ops::Key_Agreement_with_KDF
    {
    public:
 
diff --git a/src/lib/pubkey/ecdh/ecdh.h b/src/lib/pubkey/ecdh/ecdh.h
index 6ae155bc4..d967c749f 100644
--- a/src/lib/pubkey/ecdh/ecdh.h
+++ b/src/lib/pubkey/ecdh/ecdh.h
@@ -63,7 +63,7 @@ class BOTAN_PUBLIC_API(2,0) ECDH_PublicKey : public virtual EC_PublicKey
 /**
 * This class represents ECDH Private Keys.
 */
-class BOTAN_PUBLIC_API(2,0) ECDH_PrivateKey : public ECDH_PublicKey,
+class BOTAN_PUBLIC_API(2,0) ECDH_PrivateKey final : public ECDH_PublicKey,
                                   public EC_PrivateKey,
                                   public PK_Key_Agreement_Key
    {
diff --git a/src/lib/pubkey/ecdsa/ecdsa.cpp b/src/lib/pubkey/ecdsa/ecdsa.cpp
index 8b0248770..96bc50ec0 100644
--- a/src/lib/pubkey/ecdsa/ecdsa.cpp
+++ b/src/lib/pubkey/ecdsa/ecdsa.cpp
@@ -45,7 +45,7 @@ namespace {
 /**
 * ECDSA signature operation
 */
-class ECDSA_Signature_Operation : public PK_Ops::Signature_with_EMSA
+class ECDSA_Signature_Operation final : public PK_Ops::Signature_with_EMSA
    {
    public:
 
@@ -103,7 +103,7 @@ ECDSA_Signature_Operation::raw_sign(const uint8_t msg[], size_t msg_len,
 /**
 * ECDSA verification operation
 */
-class ECDSA_Verification_Operation : public PK_Ops::Verification_with_EMSA
+class ECDSA_Verification_Operation final : public PK_Ops::Verification_with_EMSA
    {
    public:
       ECDSA_Verification_Operation(const ECDSA_PublicKey& ecdsa,
diff --git a/src/lib/pubkey/ecdsa/ecdsa.h b/src/lib/pubkey/ecdsa/ecdsa.h
index 09968d687..2929059c5 100644
--- a/src/lib/pubkey/ecdsa/ecdsa.h
+++ b/src/lib/pubkey/ecdsa/ecdsa.h
@@ -60,7 +60,7 @@ class BOTAN_PUBLIC_API(2,0) ECDSA_PublicKey : public virtual EC_PublicKey
 /**
 * This class represents ECDSA Private Keys
 */
-class BOTAN_PUBLIC_API(2,0) ECDSA_PrivateKey : public ECDSA_PublicKey,
+class BOTAN_PUBLIC_API(2,0) ECDSA_PrivateKey final : public ECDSA_PublicKey,
                                    public EC_PrivateKey
    {
    public:
diff --git a/src/lib/pubkey/ecgdsa/ecgdsa.cpp b/src/lib/pubkey/ecgdsa/ecgdsa.cpp
index eb979cc1c..e5e17623f 100644
--- a/src/lib/pubkey/ecgdsa/ecgdsa.cpp
+++ b/src/lib/pubkey/ecgdsa/ecgdsa.cpp
@@ -29,7 +29,7 @@ namespace {
 /**
 * ECGDSA signature operation
 */
-class ECGDSA_Signature_Operation : public PK_Ops::Signature_with_EMSA
+class ECGDSA_Signature_Operation final : public PK_Ops::Signature_with_EMSA
    {
    public:
 
@@ -77,7 +77,7 @@ ECGDSA_Signature_Operation::raw_sign(const uint8_t msg[], size_t msg_len,
 /**
 * ECGDSA verification operation
 */
-class ECGDSA_Verification_Operation : public PK_Ops::Verification_with_EMSA
+class ECGDSA_Verification_Operation final : public PK_Ops::Verification_with_EMSA
    {
    public:
 
diff --git a/src/lib/pubkey/ecgdsa/ecgdsa.h b/src/lib/pubkey/ecgdsa/ecgdsa.h
index c34b2ce56..31d0e2be5 100644
--- a/src/lib/pubkey/ecgdsa/ecgdsa.h
+++ b/src/lib/pubkey/ecgdsa/ecgdsa.h
@@ -58,7 +58,7 @@ class BOTAN_PUBLIC_API(2,0) ECGDSA_PublicKey : public virtual EC_PublicKey
 /**
 * This class represents ECGDSA private keys.
 */
-class BOTAN_PUBLIC_API(2,0) ECGDSA_PrivateKey : public ECGDSA_PublicKey,
+class BOTAN_PUBLIC_API(2,0) ECGDSA_PrivateKey final : public ECGDSA_PublicKey,
                                     public EC_PrivateKey
    {
    public:
diff --git a/src/lib/pubkey/ecies/ecies.cpp b/src/lib/pubkey/ecies/ecies.cpp
index e295efbef..39eb08afe 100644
--- a/src/lib/pubkey/ecies/ecies.cpp
+++ b/src/lib/pubkey/ecies/ecies.cpp
@@ -21,7 +21,7 @@ namespace {
 /**
 * Private key type for ECIES_ECDH_KA_Operation
 */
-class ECIES_PrivateKey : public EC_PrivateKey, public PK_Key_Agreement_Key
+class ECIES_PrivateKey final : public EC_PrivateKey, public PK_Key_Agreement_Key
    {
    public:
       explicit ECIES_PrivateKey(const ECDH_PrivateKey& private_key) :
@@ -54,7 +54,7 @@ class ECIES_PrivateKey : public EC_PrivateKey, public PK_Key_Agreement_Key
 /**
 * Implements ECDH key agreement without using the cofactor mode
 */
-class ECIES_ECDH_KA_Operation : public PK_Ops::Key_Agreement_with_KDF
+class ECIES_ECDH_KA_Operation final : public PK_Ops::Key_Agreement_with_KDF
    {
    public:
       ECIES_ECDH_KA_Operation(const ECIES_PrivateKey& private_key, RandomNumberGenerator& rng) :
diff --git a/src/lib/pubkey/ecies/ecies.h b/src/lib/pubkey/ecies/ecies.h
index 382147db2..f7d055dea 100644
--- a/src/lib/pubkey/ecies/ecies.h
+++ b/src/lib/pubkey/ecies/ecies.h
@@ -121,7 +121,7 @@ class BOTAN_PUBLIC_API(2,0) ECIES_KA_Params
    };
 
 
-class BOTAN_PUBLIC_API(2,0) ECIES_System_Params : public ECIES_KA_Params
+class BOTAN_PUBLIC_API(2,0) ECIES_System_Params final : public ECIES_KA_Params
    {
    public:
       /**
@@ -214,7 +214,7 @@ class BOTAN_PUBLIC_API(2,0) ECIES_KA_Operation
 /**
 * ECIES Encryption according to ISO 18033-2
 */
-class BOTAN_PUBLIC_API(2,0) ECIES_Encryptor : public PK_Encryptor
+class BOTAN_PUBLIC_API(2,0) ECIES_Encryptor final : public PK_Encryptor
    {
    public:
       /**
@@ -271,7 +271,7 @@ class BOTAN_PUBLIC_API(2,0) ECIES_Encryptor : public PK_Encryptor
 /**
 * ECIES Decryption according to ISO 18033-2
 */
-class BOTAN_PUBLIC_API(2,0) ECIES_Decryptor : public PK_Decryptor
+class BOTAN_PUBLIC_API(2,0) ECIES_Decryptor final : public PK_Decryptor
    {
    public:
       /**
diff --git a/src/lib/pubkey/eckcdsa/eckcdsa.cpp b/src/lib/pubkey/eckcdsa/eckcdsa.cpp
index 778c0f833..2a320cc5a 100644
--- a/src/lib/pubkey/eckcdsa/eckcdsa.cpp
+++ b/src/lib/pubkey/eckcdsa/eckcdsa.cpp
@@ -35,7 +35,7 @@ namespace {
 /**
 * ECKCDSA signature operation
 */
-class ECKCDSA_Signature_Operation : public PK_Ops::Signature_with_EMSA
+class ECKCDSA_Signature_Operation final : public PK_Ops::Signature_with_EMSA
    {
    public:
 
@@ -106,7 +106,7 @@ ECKCDSA_Signature_Operation::raw_sign(const uint8_t msg[], size_t,
 /**
 * ECKCDSA verification operation
 */
-class ECKCDSA_Verification_Operation : public PK_Ops::Verification_with_EMSA
+class ECKCDSA_Verification_Operation final : public PK_Ops::Verification_with_EMSA
    {
    public:
 
diff --git a/src/lib/pubkey/eckcdsa/eckcdsa.h b/src/lib/pubkey/eckcdsa/eckcdsa.h
index 3d2189b79..aa04cb146 100644
--- a/src/lib/pubkey/eckcdsa/eckcdsa.h
+++ b/src/lib/pubkey/eckcdsa/eckcdsa.h
@@ -58,7 +58,7 @@ class BOTAN_PUBLIC_API(2,0) ECKCDSA_PublicKey : public virtual EC_PublicKey
 /**
 * This class represents ECKCDSA private keys.
 */
-class BOTAN_PUBLIC_API(2,0) ECKCDSA_PrivateKey : public ECKCDSA_PublicKey,
+class BOTAN_PUBLIC_API(2,0) ECKCDSA_PrivateKey final : public ECKCDSA_PublicKey,
                                     public EC_PrivateKey
    {
    public:
diff --git a/src/lib/pubkey/ed25519/ed25519.h b/src/lib/pubkey/ed25519/ed25519.h
index f295c1c41..f563115dd 100644
--- a/src/lib/pubkey/ed25519/ed25519.h
+++ b/src/lib/pubkey/ed25519/ed25519.h
@@ -62,7 +62,7 @@ class BOTAN_PUBLIC_API(2,2) Ed25519_PublicKey : public virtual Public_Key
       std::vector<uint8_t> m_public;
    };
 
-class BOTAN_PUBLIC_API(2,2) Ed25519_PrivateKey : public Ed25519_PublicKey,
+class BOTAN_PUBLIC_API(2,2) Ed25519_PrivateKey final : public Ed25519_PublicKey,
                                      public virtual Private_Key
    {
    public:
diff --git a/src/lib/pubkey/ed25519/ed25519_key.cpp b/src/lib/pubkey/ed25519/ed25519_key.cpp
index 6089cfedf..269834a33 100644
--- a/src/lib/pubkey/ed25519/ed25519_key.cpp
+++ b/src/lib/pubkey/ed25519/ed25519_key.cpp
@@ -98,7 +98,7 @@ namespace {
 /**
 * Ed25519 verifying operation
 */
-class Ed25519_Pure_Verify_Operation : public PK_Ops::Verification
+class Ed25519_Pure_Verify_Operation final : public PK_Ops::Verification
    {
    public:
       Ed25519_Pure_Verify_Operation(const Ed25519_PublicKey& key) : m_key(key)
@@ -127,7 +127,7 @@ class Ed25519_Pure_Verify_Operation : public PK_Ops::Verification
 /**
 * Ed25519 verifying operation with pre-hash
 */
-class Ed25519_Hashed_Verify_Operation : public PK_Ops::Verification
+class Ed25519_Hashed_Verify_Operation final : public PK_Ops::Verification
    {
    public:
       Ed25519_Hashed_Verify_Operation(const Ed25519_PublicKey& key, const std::string& hash) : m_key(key)
@@ -157,7 +157,7 @@ class Ed25519_Hashed_Verify_Operation : public PK_Ops::Verification
 /**
 * Ed25519 signing operation ('pure' - signs message directly)
 */
-class Ed25519_Pure_Sign_Operation : public PK_Ops::Signature
+class Ed25519_Pure_Sign_Operation final : public PK_Ops::Signature
    {
    public:
       Ed25519_Pure_Sign_Operation(const Ed25519_PrivateKey& key) : m_key(key)
@@ -185,7 +185,7 @@ class Ed25519_Pure_Sign_Operation : public PK_Ops::Signature
 /**
 * Ed25519 signing operation with pre-hash
 */
-class Ed25519_Hashed_Sign_Operation : public PK_Ops::Signature
+class Ed25519_Hashed_Sign_Operation final : public PK_Ops::Signature
    {
    public:
       Ed25519_Hashed_Sign_Operation(const Ed25519_PrivateKey& key, const std::string& hash) : m_key(key)
diff --git a/src/lib/pubkey/elgamal/elgamal.cpp b/src/lib/pubkey/elgamal/elgamal.cpp
index 5a3f19362..a44f352f5 100644
--- a/src/lib/pubkey/elgamal/elgamal.cpp
+++ b/src/lib/pubkey/elgamal/elgamal.cpp
@@ -67,7 +67,7 @@ namespace {
 /**
 * ElGamal encryption operation
 */
-class ElGamal_Encryption_Operation : public PK_Ops::Encryption_with_EME
+class ElGamal_Encryption_Operation final : public PK_Ops::Encryption_with_EME
    {
    public:
 
@@ -119,7 +119,7 @@ ElGamal_Encryption_Operation::raw_encrypt(const uint8_t msg[], size_t msg_len,
 /**
 * ElGamal decryption operation
 */
-class ElGamal_Decryption_Operation : public PK_Ops::Decryption_with_EME
+class ElGamal_Decryption_Operation final : public PK_Ops::Decryption_with_EME
    {
    public:
 
diff --git a/src/lib/pubkey/elgamal/elgamal.h b/src/lib/pubkey/elgamal/elgamal.h
index 41fac4aae..e4d932f6a 100644
--- a/src/lib/pubkey/elgamal/elgamal.h
+++ b/src/lib/pubkey/elgamal/elgamal.h
@@ -50,7 +50,7 @@ class BOTAN_PUBLIC_API(2,0) ElGamal_PublicKey : public virtual DL_Scheme_PublicK
 /**
 * ElGamal Private Key
 */
-class BOTAN_PUBLIC_API(2,0) ElGamal_PrivateKey : public ElGamal_PublicKey,
+class BOTAN_PUBLIC_API(2,0) ElGamal_PrivateKey final : public ElGamal_PublicKey,
                                      public virtual DL_Scheme_PrivateKey
    {
    public:
diff --git a/src/lib/pubkey/gost_3410/gost_3410.cpp b/src/lib/pubkey/gost_3410/gost_3410.cpp
index ee263bb96..324b7e985 100644
--- a/src/lib/pubkey/gost_3410/gost_3410.cpp
+++ b/src/lib/pubkey/gost_3410/gost_3410.cpp
@@ -94,7 +94,7 @@ BigInt decode_le(const uint8_t msg[], size_t msg_len)
 /**
 * GOST-34.10 signature operation
 */
-class GOST_3410_Signature_Operation : public PK_Ops::Signature_with_EMSA
+class GOST_3410_Signature_Operation final : public PK_Ops::Signature_with_EMSA
    {
    public:
       GOST_3410_Signature_Operation(const GOST_3410_PrivateKey& gost_3410,
@@ -150,7 +150,7 @@ GOST_3410_Signature_Operation::raw_sign(const uint8_t msg[], size_t msg_len,
 /**
 * GOST-34.10 verification operation
 */
-class GOST_3410_Verification_Operation : public PK_Ops::Verification_with_EMSA
+class GOST_3410_Verification_Operation final : public PK_Ops::Verification_with_EMSA
    {
    public:
 
diff --git a/src/lib/pubkey/gost_3410/gost_3410.h b/src/lib/pubkey/gost_3410/gost_3410.h
index cd9f03dac..52b6ad758 100644
--- a/src/lib/pubkey/gost_3410/gost_3410.h
+++ b/src/lib/pubkey/gost_3410/gost_3410.h
@@ -64,7 +64,7 @@ class BOTAN_PUBLIC_API(2,0) GOST_3410_PublicKey : public virtual EC_PublicKey
 /**
 * GOST-34.10 Private Key
 */
-class BOTAN_PUBLIC_API(2,0) GOST_3410_PrivateKey : public GOST_3410_PublicKey,
+class BOTAN_PUBLIC_API(2,0) GOST_3410_PrivateKey final : public GOST_3410_PublicKey,
                                        public EC_PrivateKey
    {
    public:
diff --git a/src/lib/pubkey/mce/mceliece.h b/src/lib/pubkey/mce/mceliece.h
index c9b2e0afc..54f043472 100644
--- a/src/lib/pubkey/mce/mceliece.h
+++ b/src/lib/pubkey/mce/mceliece.h
@@ -67,7 +67,7 @@ class BOTAN_PUBLIC_API(2,0) McEliece_PublicKey : public virtual Public_Key
       uint32_t m_code_length;
    };
 
-class BOTAN_PUBLIC_API(2,0) McEliece_PrivateKey : public virtual McEliece_PublicKey,
+class BOTAN_PUBLIC_API(2,0) McEliece_PrivateKey final : public virtual McEliece_PublicKey,
                                       public virtual Private_Key
    {
    public:
diff --git a/src/lib/pubkey/mce/mceliece_key.cpp b/src/lib/pubkey/mce/mceliece_key.cpp
index 24a6420f2..5d8378e52 100644
--- a/src/lib/pubkey/mce/mceliece_key.cpp
+++ b/src/lib/pubkey/mce/mceliece_key.cpp
@@ -294,7 +294,7 @@ bool McEliece_PublicKey::operator==(const McEliece_PublicKey& other) const
 
 namespace {
 
-class MCE_KEM_Encryptor : public PK_Ops::KEM_Encryption_with_KDF
+class MCE_KEM_Encryptor final : public PK_Ops::KEM_Encryption_with_KDF
    {
    public:
 
@@ -322,7 +322,7 @@ class MCE_KEM_Encryptor : public PK_Ops::KEM_Encryption_with_KDF
       const McEliece_PublicKey& m_key;
    };
 
-class MCE_KEM_Decryptor : public PK_Ops::KEM_Decryption_with_KDF
+class MCE_KEM_Decryptor final : public PK_Ops::KEM_Decryption_with_KDF
    {
    public:
 
diff --git a/src/lib/pubkey/pkcs8.h b/src/lib/pubkey/pkcs8.h
index 4982f4a89..b75a44180 100644
--- a/src/lib/pubkey/pkcs8.h
+++ b/src/lib/pubkey/pkcs8.h
@@ -17,7 +17,7 @@ namespace Botan {
 /**
 * PKCS #8 General Exception
 */
-struct BOTAN_PUBLIC_API(2,0) PKCS8_Exception : public Decoding_Error
+struct BOTAN_PUBLIC_API(2,0) PKCS8_Exception final : public Decoding_Error
    {
    explicit PKCS8_Exception(const std::string& error) :
       Decoding_Error("PKCS #8: " + error) {}
diff --git a/src/lib/pubkey/rfc6979/rfc6979.h b/src/lib/pubkey/rfc6979/rfc6979.h
index 2afe9ca9a..d78effc26 100644
--- a/src/lib/pubkey/rfc6979/rfc6979.h
+++ b/src/lib/pubkey/rfc6979/rfc6979.h
@@ -16,7 +16,7 @@ namespace Botan {
 
 class HMAC_DRBG;
 
-class BOTAN_PUBLIC_API(2,0) RFC6979_Nonce_Generator
+class BOTAN_PUBLIC_API(2,0) RFC6979_Nonce_Generator final
    {
    public:
       /**
diff --git a/src/lib/pubkey/rsa/rsa.cpp b/src/lib/pubkey/rsa/rsa.cpp
index cafe6b069..bd02d1f19 100644
--- a/src/lib/pubkey/rsa/rsa.cpp
+++ b/src/lib/pubkey/rsa/rsa.cpp
@@ -239,7 +239,7 @@ class RSA_Private_Operation
       Blinder m_blinder;
    };
 
-class RSA_Signature_Operation : public PK_Ops::Signature_with_EMSA,
+class RSA_Signature_Operation final : public PK_Ops::Signature_with_EMSA,
                                 private RSA_Private_Operation
    {
    public:
@@ -263,7 +263,7 @@ class RSA_Signature_Operation : public PK_Ops::Signature_with_EMSA,
          }
    };
 
-class RSA_Decryption_Operation : public PK_Ops::Decryption_with_EME,
+class RSA_Decryption_Operation final : public PK_Ops::Decryption_with_EME,
                                  private RSA_Private_Operation
    {
    public:
@@ -286,7 +286,7 @@ class RSA_Decryption_Operation : public PK_Ops::Decryption_with_EME,
          }
    };
 
-class RSA_KEM_Decryption_Operation : public PK_Ops::KEM_Decryption_with_KDF,
+class RSA_KEM_Decryption_Operation final : public PK_Ops::KEM_Decryption_with_KDF,
                                      private RSA_Private_Operation
    {
    public:
@@ -335,7 +335,7 @@ class RSA_Public_Operation
       Fixed_Exponent_Power_Mod m_powermod_e_n;
    };
 
-class RSA_Encryption_Operation : public PK_Ops::Encryption_with_EME,
+class RSA_Encryption_Operation final : public PK_Ops::Encryption_with_EME,
                                  private RSA_Public_Operation
    {
    public:
@@ -356,7 +356,7 @@ class RSA_Encryption_Operation : public PK_Ops::Encryption_with_EME,
          }
    };
 
-class RSA_Verify_Operation : public PK_Ops::Verification_with_EMSA,
+class RSA_Verify_Operation final : public PK_Ops::Verification_with_EMSA,
                              private RSA_Public_Operation
    {
    public:
@@ -378,7 +378,7 @@ class RSA_Verify_Operation : public PK_Ops::Verification_with_EMSA,
          }
    };
 
-class RSA_KEM_Encryption_Operation : public PK_Ops::KEM_Encryption_with_KDF,
+class RSA_KEM_Encryption_Operation final : public PK_Ops::KEM_Encryption_with_KDF,
                                      private RSA_Public_Operation
    {
    public:
diff --git a/src/lib/pubkey/rsa/rsa.h b/src/lib/pubkey/rsa/rsa.h
index 09c945c82..ad4fceab9 100644
--- a/src/lib/pubkey/rsa/rsa.h
+++ b/src/lib/pubkey/rsa/rsa.h
@@ -79,7 +79,7 @@ class BOTAN_PUBLIC_API(2,0) RSA_PublicKey : public virtual Public_Key
 /**
 * RSA Private Key
 */
-class BOTAN_PUBLIC_API(2,0) RSA_PrivateKey : public Private_Key, public RSA_PublicKey
+class BOTAN_PUBLIC_API(2,0) RSA_PrivateKey final : public Private_Key, public RSA_PublicKey
    {
    public:
       /**
diff --git a/src/lib/pubkey/sm2/sm2.cpp b/src/lib/pubkey/sm2/sm2.cpp
index dbb22ca6d..1b20ee6fa 100644
--- a/src/lib/pubkey/sm2/sm2.cpp
+++ b/src/lib/pubkey/sm2/sm2.cpp
@@ -74,7 +74,7 @@ namespace {
 /**
 * SM2 signature operation
 */
-class SM2_Signature_Operation : public PK_Ops::Signature
+class SM2_Signature_Operation final : public PK_Ops::Signature
    {
    public:
 
@@ -131,7 +131,7 @@ SM2_Signature_Operation::sign(RandomNumberGenerator& rng)
 /**
 * SM2 verification operation
 */
-class SM2_Verification_Operation : public PK_Ops::Verification
+class SM2_Verification_Operation final : public PK_Ops::Verification
    {
    public:
       SM2_Verification_Operation(const SM2_Signature_PublicKey& sm2,
diff --git a/src/lib/pubkey/sm2/sm2.h b/src/lib/pubkey/sm2/sm2.h
index bb88065f5..7f702e134 100644
--- a/src/lib/pubkey/sm2/sm2.h
+++ b/src/lib/pubkey/sm2/sm2.h
@@ -58,7 +58,7 @@ class BOTAN_PUBLIC_API(2,2) SM2_Signature_PublicKey : public virtual EC_PublicKe
 /**
 * This class represents SM2 Signature private keys
 */
-class BOTAN_PUBLIC_API(2,2) SM2_Signature_PrivateKey : public SM2_Signature_PublicKey,
+class BOTAN_PUBLIC_API(2,2) SM2_Signature_PrivateKey final : public SM2_Signature_PublicKey,
                                            public EC_PrivateKey
    {
    public:
diff --git a/src/lib/pubkey/sm2/sm2_enc.cpp b/src/lib/pubkey/sm2/sm2_enc.cpp
index 2d44faacb..b697daf1e 100644
--- a/src/lib/pubkey/sm2/sm2_enc.cpp
+++ b/src/lib/pubkey/sm2/sm2_enc.cpp
@@ -42,7 +42,7 @@ SM2_Encryption_PrivateKey::SM2_Encryption_PrivateKey(RandomNumberGenerator& rng,
 
 namespace {
 
-class SM2_Encryption_Operation : public PK_Ops::Encryption
+class SM2_Encryption_Operation final : public PK_Ops::Encryption
    {
    public:
       SM2_Encryption_Operation(const SM2_Encryption_PublicKey& key, const std::string& kdf_hash) :
@@ -119,7 +119,7 @@ class SM2_Encryption_Operation : public PK_Ops::Encryption
       const std::string m_kdf_hash;
    };
 
-class SM2_Decryption_Operation : public PK_Ops::Decryption
+class SM2_Decryption_Operation final : public PK_Ops::Decryption
    {
    public:
       SM2_Decryption_Operation(const SM2_Encryption_PrivateKey& key,
diff --git a/src/lib/pubkey/xmss/xmss_privatekey.h b/src/lib/pubkey/xmss/xmss_privatekey.h
index b5cbf9cac..5936009bd 100644
--- a/src/lib/pubkey/xmss/xmss_privatekey.h
+++ b/src/lib/pubkey/xmss/xmss_privatekey.h
@@ -36,7 +36,7 @@ namespace Botan {
  *       https://datatracker.ietf.org/doc/
  *       draft-irtf-cfrg-xmss-hash-based-signatures/?include_text=1
  **/
-class BOTAN_PUBLIC_API(2,0) XMSS_PrivateKey : public virtual XMSS_PublicKey,
+class BOTAN_PUBLIC_API(2,0) XMSS_PrivateKey final : public virtual XMSS_PublicKey,
                                   public XMSS_Common_Ops,
                                   public virtual Private_Key
    {
diff --git a/src/lib/pubkey/xmss/xmss_signature_operation.h b/src/lib/pubkey/xmss/xmss_signature_operation.h
index 7a5845818..f974213e0 100644
--- a/src/lib/pubkey/xmss/xmss_signature_operation.h
+++ b/src/lib/pubkey/xmss/xmss_signature_operation.h
@@ -32,7 +32,7 @@ namespace Botan {
  *     https://datatracker.ietf.org/doc/
  *     draft-irtf-cfrg-xmss-hash-based-signatures/?include_text=1
  **/
-class XMSS_Signature_Operation : public virtual PK_Ops::Signature,
+class XMSS_Signature_Operation final : public virtual PK_Ops::Signature,
                                  public XMSS_Common_Ops
    {
    public:
diff --git a/src/lib/pubkey/xmss/xmss_verification_operation.h b/src/lib/pubkey/xmss/xmss_verification_operation.h
index de8816134..f5079303c 100644
--- a/src/lib/pubkey/xmss/xmss_verification_operation.h
+++ b/src/lib/pubkey/xmss/xmss_verification_operation.h
@@ -25,7 +25,7 @@ namespace Botan {
  * Signatures (XMSS).
  **/
  class XMSS_Verification_Operation
-   : public virtual PK_Ops::Verification,
+   final : public virtual PK_Ops::Verification,
      public XMSS_Common_Ops
    {
    public:
diff --git a/src/lib/pubkey/xmss/xmss_wots_addressed_privatekey.h b/src/lib/pubkey/xmss/xmss_wots_addressed_privatekey.h
index f3031818c..227ef211c 100644
--- a/src/lib/pubkey/xmss/xmss_wots_addressed_privatekey.h
+++ b/src/lib/pubkey/xmss/xmss_wots_addressed_privatekey.h
@@ -22,7 +22,7 @@ namespace Botan {
  * XMSS_WOTS_Signature_Operation() on creation.
  **/
 class XMSS_WOTS_Addressed_PrivateKey
-   : public virtual XMSS_WOTS_Addressed_PublicKey,
+   final : public virtual XMSS_WOTS_Addressed_PublicKey,
      public virtual Private_Key
    {
    public:
diff --git a/src/lib/pubkey/xmss/xmss_wots_privatekey.h b/src/lib/pubkey/xmss/xmss_wots_privatekey.h
index fa8a23cad..8fb4e0233 100644
--- a/src/lib/pubkey/xmss/xmss_wots_privatekey.h
+++ b/src/lib/pubkey/xmss/xmss_wots_privatekey.h
@@ -23,7 +23,7 @@ namespace Botan {
 /** A Winternitz One Time Signature private key for use with Extended Hash-Based
  * Signatures.
  **/
-class BOTAN_PUBLIC_API(2,0) XMSS_WOTS_PrivateKey : public virtual XMSS_WOTS_PublicKey,
+class BOTAN_PUBLIC_API(2,0) XMSS_WOTS_PrivateKey final : public virtual XMSS_WOTS_PublicKey,
                                        public virtual Private_Key
    {
    public:
diff --git a/src/lib/pubkey/xmss/xmss_wots_signature_operation.h b/src/lib/pubkey/xmss/xmss_wots_signature_operation.h
index 271766e87..5873c4ec4 100644
--- a/src/lib/pubkey/xmss/xmss_wots_signature_operation.h
+++ b/src/lib/pubkey/xmss/xmss_wots_signature_operation.h
@@ -24,7 +24,7 @@ namespace Botan {
  * This operation is not intended for stand-alone use and thus not registered
  * in the Botan algorithm registry.
  ***/
-class XMSS_WOTS_Signature_Operation : public virtual PK_Ops::Signature,
+class XMSS_WOTS_Signature_Operation final : public virtual PK_Ops::Signature,
                                       public XMSS_WOTS_Common_Ops
    {
    public:
diff --git a/src/lib/pubkey/xmss/xmss_wots_verification_operation.h b/src/lib/pubkey/xmss/xmss_wots_verification_operation.h
index 3575e320a..863e05de7 100644
--- a/src/lib/pubkey/xmss/xmss_wots_verification_operation.h
+++ b/src/lib/pubkey/xmss/xmss_wots_verification_operation.h
@@ -25,7 +25,7 @@ namespace Botan {
  * in the Botan algorithm registry.
  **/
 class XMSS_WOTS_Verification_Operation
-   : public virtual PK_Ops::Verification,
+   final : public virtual PK_Ops::Verification,
      public XMSS_WOTS_Common_Ops
    {
    public: