And that'd be awful for many use cases, because maximizing that would make it incredibly unwieldy and brittle. For instance if you want to deal with keyrings,

And that'd be awful for many use cases, because maximizing that would make it incredibly unwieldy and brittle. For instance if you want to deal with keyrings, and be fully philosophy compliant, then that might be a gpg-keyring tool, which means now we have a problem. A signature operates on both a key and a file, and a pipe only works on one stream. Then there's the issue with error handling, since any of those bits can go wrong, and then somebody has to figure out a good way of dealing with all of that. Or, we could have libgpg instead, in which case our mail client could avoid screwing around with text streams, signals and process management, and just have a nice API with features like callbacks and well defined datatypes that would be a lot more comfortable to use. EDIT: Even with just the 3 primitives you've outlined, we already can create a huge mess. Is it sign then encrypt, or encrypt then sign? We can combine signing, armoring and encrypting in any order and any amount, requiring the recipient of this insanity to somehow figure out what we did, and then somebody else will do it differently.