Obviously, "msg.sh" is only "easy" to use on something like a Ubuntu/Linux desktop that comes with (ba)sh and gpg -- and it's only "easy to audit" for technical

Obviously, "msg.sh" is only "easy" to use on something like a Ubuntu/Linux desktop that comes with (ba)sh and gpg -- and it's only "easy to audit" for technical users. It's still easy enough to swap out the contents of "msg.sh" with something nefarious that sends the contents of ~/Maildir to a remote server or whatever. The point being, if the user can't trust the framework (in this case, operating system, shell and gpg executable) there can be no trust in the handling of data either. But blindly running code (be that a shell-script or javascript code) is generally a bad idea...