PGP/GPG adoption needs to go way up, but I am concerned by the rise of "non-owned" devices. I would put way less trust in running PGP/GPG from a client-side ma

PGP/GPG adoption needs to go way up, but I am concerned by the rise of "non-owned" devices. I would put way less trust in running PGP/GPG from a client-side mail client on a smartphone with OTA updates, apparent carrier spyware, etc than I would in PGP/GPG running on OSX, for instance. Maybe one way to partially mitigate these concerns is to push for only storing/using private keys on these devices on a TPM.