23:59 <raggi> actually gpg probably /is/ broken by the nsa, in that it only supports some very old algorithms. it's pretty shitty tbh. if you want modern crypto then nacl is a better target, but then you also drop NIST assurances and so on, which is what makes the traditional suites a better choice

23:59 <raggi> however, TUF has almost nothing to do with specific cipher suites, or tools that surround them

23:59 <raggi> it's about establishing a chain of trust all the way from the author, through mirrors and collections of packages, down to individual installs