> Most people would want to know a backup is corrupt before they started the restore, not partway through it. Yes, which often makes OpenPGP a bad choice, beca

> Most people would want to know a backup is corrupt before they started the restore, not partway through it. Yes, which often makes OpenPGP a bad choice, because of how it has to authenticate things (requiring multiple passes). Many implementations of OpenPGP will happily release unauthenticated plaintext to the caller (and then fail at the end when the MAC fails- too late if you piped that to tar!) - there isn't an efficient way to do better than this with OpenPGP, because...well, it isn't very good.