In Search of a Good GnuPG Frontend
I'm fine with managing my GnuPG/PGP keys from the command line, but I'm sure a lot of people aren't. And if more people are going to start using GnuPG and other privacy-protecting technologies, there has to be a GUI.
The core assumption I'm making here is that regular users should be able to use GnuPG effectively without ever opening a command line. Here is my reasoning for that: Users should not have to use a command line to perform everyday tasks on a personal computer. If using these technologies is to become an everyday task, then they shouldn't require a command line.
While there are a lot of GUI frontends for GnuPG, I haven't found one that performs all the basic (in my opinion) key-management tasks. As a result, people will still have to use the command line, and I will have a hard time recommending GnuPG to non-technical people.
Here is my list of basic key-management tasks:
Create new keys: Obviously nobody starts off with a key, so there has to be a way to make one.
Publish keys to and refresh keys from the keyserver network: Publishing keys makes key signing much easier (all you need to do is check fingerprints), and it's the main way revocations are communicated.
Sign other people's keys: Establishing a web of trust is crucial to GnuPG.
Create subkeys: When you create a new key, GnuPG will create only one subkey, which is used for encryption. Signing of regular messages will be done with the primary key in this case. It's a good idea to have subkeys for both signing and encryption, so this means creating a signing subkey.
Set key and subkey expirations: Keys should expire, and if a key is still secure, the expiration should be extended.
Revoke keys and subkeys: Bad things happen, and revoking keys is sometimes necessary. This is one reason it's good to have subkeys (refer to previous item).
The only frontend I've found that does all these things is Seahorse. Unfortunately, Seahorse is currently only available on Linux, which means I can't recommend it to a majority of poeple (who use Windows or Mac). Plus, I have a problem with Seahorse: It doesn't have any visible indication that it's in the process of generating a new key. Because generating a new key takes a while, it looks as if the key generation just failed silently. The only way you can tell it's working is examining the process table.
A lot of the other frontends I tried fail on task #4, creating subkeys, and I'm not entirely sure why. Then again, I'm not a security expert, so maybe this is because creating subkeys isn't as important as I said.
In alphabetical order, here are the other frontends I tried.
Enigmail is a plugin for Mozilla Thunderbird (cross-platform). Despite being just an e-mail plugin, it has a lot of key-management features. I'm using version 1.9.4.
Publish keys to and refresh keys from the keyserver network: Yes
Sign other people's keys: Yes
Set key and subkey expirations: Yes
Revoke keys and subkeys: Primary keys only
GNU Privacy Assistant (GPA)
GPA is a GTK+ 2-based frontend for Linux and Windows (it's included in Gpg4win). I'm using version 0.9.9 (0.9.9-4 from Debian Testing, and 0.9.9 from Gpg4win 2.3.2).
Publish keys to and refresh keys from the keyserver network: Yes
Sign other people's keys: Yes
Set key and subkey expirations: Primary keys only
Revoke keys and subkeys: No
This is the primary GnuPG software bundle for OS X. I haven't tried this because I don't have access to a Mac system, although I wouldn't be surprised if it doesn't do all of the tasks.
Kgpg is a frontend for KDE (Linux). I'm using version 16.04.2 (4:16.04.2-1 from Debian Testing).
Publish keys to and refresh keys from the keyserver network: Yes
Sign other people's keys: Yes
Set key and subkey expirations: Primary keys only
Revoke keys and subkeys: Technically yes. What you have to do is create a revocation certificate on disk and then import it. There is an option to import the certificate immediately after creating it, but it always fails with an error message.
Kleopatra is another frontend for KDE (Linux), and it's also included in Gpg4win (Windows). I'm using version 4.14.10 (4:4.14.10-2 from Debian Testing) on Linux and version 2.2.0-gitfb4ae3d (from Gpg4win 2.3.2).
Publish keys to and refresh keys from the keyserver network: Yes
Sign other people's keys: Yes
Set key and subkey expirations: Primary keys only
Revoke keys and subkeys: No
If I got any of the features wrong, please let me know. (Maybe it was hidden in a menu somewhere and I couldn't find it.) And, like I said, I'm not a security expert, so I'm anticipating some disagreement about the list of tasks.