At a minimum, it is a testament to the difficulty of using the gnupg commandline interface (and/or its API; does it have a C API?) properly. For instance, you

At a minimum, it is a testament to the difficulty of using the gnupg commandline interface (and/or its API; does it have a C API?) properly. For instance, you might ask why the default is to print any of the plaintext of a message that fails the integrity check. If the interface/API of gnupg had operated differently, then maybe even "buggy" users of gnupg would have been protected. Computer security must make it easy to do safe things; if unsafe things can't be (or mustn't be) made impossible, they should be made difficult.