Is the OpenPGP thing supposed to inspire confidence? Given OpenPGP's use of custom KDFs [1], weak default hash functions (SHA1) and questionable ciphers (CAST5

Is the OpenPGP thing supposed to inspire confidence? Given OpenPGP's use of custom KDFs [1], weak default hash functions (SHA1) and questionable ciphers (CAST5? really?), it certainly doesn't for me. While none of this falls under the "completely broken" category, it certainly could be better... My main concern with anything using OpenPGP is that it only takes one of these things to fall before a deep compromise is possible. There's a reason many cryptographers are anti-cipher choice. It'd be quite possible to write similar using NaCl/libsodium and achieve a higher margin of security. [1]: http://tools.ietf.org/html/rfc4880#section-3.7.1.3 http://tools.ietf.org/html/rfc4880#section-3.7.1.3 EDIT: It seems my knowledge of this may actually be dated, GPG at least has shifted away from many of these defaults https://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000357.html https://lists.gnupg.org/pipermail/gnupg-announce/2014q4/0003...