signing emails is by far not the only use-case for gpg. The entire package signing infrastructure of all linux distributions is underpinned by gpg. Even if they

signing emails is by far not the only use-case for gpg. The entire package signing infrastructure of all linux distributions is underpinned by gpg. Even if they spend all of the 15K each month on having a single developer audit and improve the code-base, I'd be fine with that.