I used to put .gpg files in my repos that stored sensitive information like database passwords and such.<p>I don&#x27;t do that anymore. The main problem as I saw it was that you basically liberate your security to an environment you can&#x27;t monitor or send rejections to (if someone downloads your gpg file). Compare this to an ssh server which affords both those abilities.