While you can&#x27;t know without looking at the code, my first-pass test is asking how keys are handled and if the code handling those keys is coming from an untrusted source (in this case the server as JS)(for the sake of this discussion I will admit I implicitly trust Debian and the gpg folks).<p>If there isn&#x27;t a good answer to key management, or my key is handled by JS, then it&#x27;s a no-go for me.<p>If there is a half-way decent answer to key management, I ask what the threat vectors the system was designed for are. If a broad political statement is made, then I walk away.<p>While it doesn&#x27;t actually vet the technical merit of the code, I feel it catches a lot of funniness.