Why not use GPG directly? I get the wish to not add more binary dependencies, but the recent couple of issues with Go's math and crypto libraries doesn't fill me with confidence. Not to mention that there's no real benefit to adding your own wrappers around the crypto primitives when GPG already exists.