There is certainly a need for consultants to help organizations do PGP-style security well. And it doesn't look like they're transforming GnuPG into an open co

There is certainly a need for consultants to help organizations do PGP-style security well. And it doesn't look like they're transforming GnuPG into an open core product model with critical components only available commercially. So, this seems good? It doesn't look like they've been bought by anybody (e.g. a VC) who's going to require the sort of rate of return that can only be attempted (and probably not achieved) by doing things incompatible with GnuPG's role in the open source ecosystem. Not every company has to be huge — GnuPG can have outsized positive impact on the world while remaining small and sustainable.