PGP (by which I mean GPG's OpenPGP implementation) will show you the type and size of a public key. It can't tell you that they have a shitty password or have t

PGP (by which I mean GPG's OpenPGP implementation) will show you the type and size of a public key. It can't tell you that they have a shitty password or have their private key password printed on their t-shirt. When you receive a message the session key was encrypted with your public key so it's only as good as your key. You can check out an encrypted message to see what symmetric cipher and digest was used. While GPG could throw up a warning there's nothing you can do about a weak symmetric key or digest. There's no return channel to the sender and no handshake. In the case of signed packages the issues of poor digests is more the fault of the repository. They are the ones that need to enforce the digests and asymmetric key types they support. They could easily reject MD5 signatures and small public keys.