Since OpenPGP is normally used in offline and stateless applications like encrypted email and encrypted files there is no need for some sort of session oriented

Since OpenPGP is normally used in offline and stateless applications like encrypted email and encrypted files there is no need for some sort of session oriented authentication. The content itself is signed and thus authenticated. So the MDC is not normally needed either, it is just an integrity check for the edge case of unauthenticated encryption. The only time the alleged deficiencies of the MDC come into play is when doing symmetrical encryption. This article covers this in more detail: * https://articles.59.ca/doku.php?id=pgpfan:authenticated https://articles.59.ca/doku.php?id=pgpfan:authenticated So if OpenPGP never gets upgraded authenticated encryption no one will care much.