It's both. GnuPG has very poor UX and it's also so old and so well-known that it kills a lot of the "unknown upstarts". I think on balance GnuPG reduces the sec

It's both. GnuPG has very poor UX and it's also so old and so well-known that it kills a lot of the "unknown upstarts". I think on balance GnuPG reduces the security of network communications and the appeal of a web of trust PKI because it's presented as "the main player", people try to use it, realize that the UX is garbage, and become disillusioned in the technology behind it.