GPG is now a poor encryption tool?

[Ayush Agarwal]

Hi Paul,

I've been considering writing a patch which would make pass choose
between age[^1] and gpg during `pass init` although it seems like
Filippo Valsorda already has this on his list of goals[^2].

I won't say much about gpg considering I'm not a cryptographer but I'd
like to point out that if you want to create ed25519 key pairs using
gpg, you have execute `gpg --expert --full-gen-key` as of gpg version
2.2.x. The man page of gpg describes the `--expert` flag as "allow the
user to do certain nonsensical or silly things ...". This isn't really
the user experience a modern encryption tool should have, to say the
least.

If I'm not mistaken, gpg version 2.3.x, which has been released
recently, may have switched to ed25519 key pairs by default but that
doesn't really solve the problem that gpg allows you to shoot yourself
in the foot by using algorithms and protocols which should have been
deprecated and removed a long time ago but haven't been for the sake of
backwards compatibility.

[^1]: https://github.com/FiloSottile/age
[^2]: https://docs.google.com/document/d/11yHom20CrsuX8KQJXBBw04s80Unjv8zCg_A7sPAX_9Y/edit#

Regards,
Ayush