Is the OpenPGP thing supposed to inspire confidence?<p>Given OpenPGP&#x27;s use of custom KDFs [1], weak default hash functions (SHA1) and questionable ciphers (CAST5? really?), it certainly doesn&#x27;t for me. While none of this falls under the &quot;completely broken&quot; category, it certainly could be better... My main concern with anything using OpenPGP is that it only takes one of these things to fall before a deep compromise is possible. There&#x27;s a reason many cryptographers are anti-cipher choice.<p>It&#x27;d be quite possible to write similar using NaCl&#x2F;libsodium and achieve a higher margin of security.<p>[1]: <a href="http:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc4880#section-3.7.1.3" rel="nofollow">http:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc4880#section-3.7.1.3</a><p>EDIT: It seems my knowledge of this may actually be dated, GPG at least has shifted away from many of these defaults<p><a href="https:&#x2F;&#x2F;lists.gnupg.org&#x2F;pipermail&#x2F;gnupg-announce&#x2F;2014q4&#x2F;000357.html" rel="nofollow">https:&#x2F;&#x2F;lists.gnupg.org&#x2F;pipermail&#x2F;gnupg-announce&#x2F;2014q4&#x2F;0003...</a>