GPG support? (like SSH)

GPG keys can not only be used for signing commits but also used to sign and encrypt files, emails and other data. We'd love to see GPG support in 1Password.

Finally, it's worth noting that while SSH keys can be used to sign git commits, the level of trust is not as meaningful as a GPG one, due to the absence of infrastructure like keybase, which verifies the authenticity of the signer.

Apparently that’s even an (user…) issue with GPG:

https://blog.pypi.org/posts/2023-05-23-removing-pgp/

GPG/PGP offers various features for security & privacy. It supports keyservers (are there good methods/servers for doing that with SSH keys?), making it convenient to publish your key.
Additionally, it allows the use of revocation certificates and the creation of master and sub keys, which can be particularly beneficial for organizations. With GPG/PGP, you have the ability to sign commits, as well as sign and encrypt emails, text, individual files, and git commits.

Furthermore, GPG/PGP can be used to securely share credentials with others, even when using platforms or channels that may not prioritize privacy, using their pub key, obtained from e.g. keybase.

Finally, it's worth noting that while SSH keys can be used to sign git commits, the level of trust is not as meaningful as a GPG one, due to the absence of infrastructure like keybase, which verifies the authenticity of the signer.

I started watching this issue 15 months ago, shortly after it was opened.

• I use GPG for signing my Git commits
• I use it for signing/encrypting emails
• I use it with GoReleaser to generate GPG signatures for software packages I release
• I use it with Keybase.io
• I use it to encrypt new credentials for people who do not yet have a password manager, so that I can send them over Slack and email.

In the interim, I've been using https://gpgtools.org (macOS) with https://github.com/jorgelbg/pinentry-touchid for a reasonably modern GPG experience.

Would love to have support for GnuPG / PGP as well. Been using it for years for commit signing, file encryption / signatures, and for communication.

GnuPG/PGP is almost entirely different from SSH. Having one does not make up for not having the other. The whole point of 1password is to support all of these different tools in one system. Please stop distracting with SSH and just implement similar GnuPG support.

After having the pleasure of using 1Password's SSH agent, I am also very excited about the possibility of using my GnuPG keys with 1Password and a https://www.gnupg.org/documentation/manuals/gnupg/Agent-Protocol.html#Agent-Protocol. SSH is nice, but I value GnuPG's sub keys support greatly.

• I generally manage my identity with GnuPG keys, not SSH keys.
• It's already been mentioned, but key servers for verification is great.
  • The ability to publish and revoke these keys.
• Being able to create distinct sub keys allows me to avoid using a master key.
  • I can sign for things using dedicated signing keys.
  • I can encrypt things using dedicated encryption keys.

From what I understand, if you wanted any of this without GnuPG you would have to use certificates and certificate authorities.

Chiming in to echo that I'd love GPG support!

+1 for this. Even with SSH signing I'd love GPG support for email among other things. It would beat adding my key as a file.

Thanks for your feedback ionos!

Jack