(Disclaimer: I'm not very knowledgeable with GPG, I assume that the warning means that the message hasn't been properly signed.) > I'd rather see "message coul

(Disclaimer: I'm not very knowledgeable with GPG, I assume that the warning means that the message hasn't been properly signed.) > I'd rather see "message could not be verified", followed by the decrypted content anyways, rather than not get any output. I know not to trust it, so knowing what it says is useful in terms of threat identification. You would know not to trust it, but it would be very easy for a novice user without an understanding of the implications to assume that it's just a minor error ("tech sometimes throws errors, but it works anyway, so why worry?"). But it damn sure is not! My suggestion would be to print an elaborate and strong warning about the implications and provide an option to look at the message if you really know that it should not be trusted in the slightest. This is how browsers handle TLS certificate issues and I'd call it a lot safer than showing the website anyway and displaying a small warning with some technical jargon.