Having a hard time verifying the trustworthiness of GPGTools. I really want to trust the project as it adds a lot of convenience on macOS, but can’t figure out if I can without spending a lot of time auditing the codebase.
The pinentry-mac git repository, for example, has only a few contributors with no public track record. I’m not insinuating they are bad actors (they are probably awesome), but I live by the motto "don’t trust, verify".
I feel safer using gnupg when installed using
brew install gnupg as it's maintained by the core team of GnuPG.
That being said, I’ve hit an edge case with
pinentry-curses and people recommend using pinentry-mac.