>how am I supposed to report security issues without gpg? I’ve never understood this obsession with using PGP to deliver security reports (even a lot of pen te

>how am I supposed to report security issues without gpg? I’ve never understood this obsession with using PGP to deliver security reports (even a lot of pen testing firms do it). We trust TLS to secure all sorts of remarkably sensitive data, why do we need to add an extra layer of encryption to security reports? It just seems like an unnecessary barrier to delivering the report to me, and the user experience is terrible. On top of that managing keys and ciphertexts is an unnecessary pain. Any time I see a public key that’s some org published years or even months ago, all I can think is that in the time since they generated that, they have absolutely had a number of people who had access to the private key resign. To me, the only threat model where something like that makes sense, is if you think your critical service providers or the government is a threat actor, and in that case PGP probably isn’t going to be enough.