> GnuPG has stood up pretty well for three decades

Make sure you also look for libgcrypt, which had a lot of cryptographic weaknesses in the 2010s.

https://www.cvedetails.com/vulnerability-list/vendor_id-4711...