> PGP is well tested and most of the bugs have been worked out. Most of them. You're either using gnupg or you're using some custom PGP implementation. A cus

> PGP is well tested and most of the bugs have been worked out. Most of them. You're either using gnupg or you're using some custom PGP implementation. A custom PGP implementation has far more footguns than a restricted JWT implementation. Gnupg is a deeply terrifying codebase- for example, did you know you're not supposed to use the exit code of gpg --verify? You must parse statusfd, too, or many bugs will let you spoof signatures. (Bugs found as recently as this year). I'd encourage anybody considering using gnupg for anything to read mainproc.c and see if they understand what's going on.