If you assume the rest of his comment is true (I'm no crypto expert but it seems intuitive enough for me, and he is a crypto expert!), having something like a s

If you assume the rest of his comment is true (I'm no crypto expert but it seems intuitive enough for me, and he is a crypto expert!), having something like a session cookie (which can be attacker controlled) encrypted with GPG (which means it's now "online", without manual intervention) has now increased the attack surface considerably; it gives up the neat offline part of GPG and makes it easier to attack. That's how I understood it anyway!