GPG RSA is much leakier than the other things you mention, because it iterates through the bits of the plaintext doing either a lot of work or a little work at

GPG RSA is much leakier than the other things you mention, because it iterates through the bits of the plaintext doing either a lot of work or a little work at each bit if it's 1 or 0. Smarter implementations of RSA do the same amount of work every time, discarding it when the bit is 0.