GPG support? (like SSH)

+1 for sure!

+1 to this request.

I would love to see 1Password have a built-in GPG agent, just like it does currently for SSH. It's an awesome, seamless, cross-platform experience, both in GUI and in command-line. Please bring it to us!

+1 (also for @aleon1220s recommendation)

It would be very helpful to derive the public key from the secret, so you can easily access it while securely store the private key.

gpg-agent integration would be awesome! (I guess this is what most mean with "like ssh")

+1

+1 but maybe support for other encryption mechanisms and certificates as well. thanks

+1!

I'd like to clarify my specific part of wanting GPG support. I'd like to have 1PW serve as my gpg-agent process much like it serves as my ssh-agent. This way, when I attempt to use an agent feature, I'm prompted for my password and the agent provides the necessary key. Additionally, having an option to require the 1PW password whenever a key is used similar to a Credit Card entry would be nice!

I feel like one of the advantages GPG keys offer over SSH keys for signing content is the availability of sub keys for different personas. For example, I'm the same person at work and in personal life, but I can have separate keys for both personas as subkeys to my main key. This is how maintainers of several Linux distributions are encouraged to use GPG, and it seems generally like a good practice. Additionally, as already mentioned, GPG can be used to sign and encrypt email, text files, backups, and a host of other things beyond simply signing git commits. GPG public keys are also discoverable, which makes them much easier to use for communication purposes.

Thanks for all the great work on 1PW so far!

GPG keys can not only be used for signing commits but also used to sign and encrypt files, emails and other data. We'd love to see GPG support in 1Password.

Finally, it's worth noting that while SSH keys can be used to sign git commits, the level of trust is not as meaningful as a GPG one, due to the absence of infrastructure like keybase, which verifies the authenticity of the signer.

Apparently that’s even an (user…) issue with GPG:

https://blog.pypi.org/posts/2023-05-23-removing-pgp/

GPG/PGP offers various features for security & privacy. It supports keyservers (are there good methods/servers for doing that with SSH keys?), making it convenient to publish your key.
Additionally, it allows the use of revocation certificates and the creation of master and sub keys, which can be particularly beneficial for organizations. With GPG/PGP, you have the ability to sign commits, as well as sign and encrypt emails, text, individual files, and git commits.

Furthermore, GPG/PGP can be used to securely share credentials with others, even when using platforms or channels that may not prioritize privacy, using their pub key, obtained from e.g. keybase.

Finally, it's worth noting that while SSH keys can be used to sign git commits, the level of trust is not as meaningful as a GPG one, due to the absence of infrastructure like keybase, which verifies the authenticity of the signer.