My reason for hand-rolling it was wrong

Description and use

The author replaced a custom OpenPGP implementation with ProtonMail/go-crypto, finding that the library supports KMS‑based signing but lacks an ECDH decryption interface and increases dependency footprint and CVEs.

Problem

The author needed to use OpenPGP in Go with a key stored in a KMS that cannot expose private key material, but the maintained library ProtonMail/go-crypto seemed unable to support this.

Outcome

Replacing the hand‑rolled code with go-crypto eliminated the need for custom packet logic, but exposed gaps in ECDH support and increased the dependency footprint with associated CVEs.

Workflow

• 1. Deleted the 400‑line hand‑rolled package.
• 2. Replaced it with ProtonMail/go-crypto in go.mod.
• 3. Ran acceptance tests to verify functionality.
• 4. Observed that packet.PrivateKey accepts a crypto.Signer, enabling KMS signing.
• 5. Noted that ECDH decryption still requires a concrete *ecdh.PrivateKey and lacks a crypto.Decrypter interface.
• 6. Compared dependency footprints and CVE counts before and after.
• 7. Reviewed open PRs and issues for ECDH support.
• 8. Updated tests to compare session keys between go-crypto and gpg.

Evidence

I deleted the package. Actually removed it (not "decided not to use it", gone), wired go-crypto in its place, and ran the acceptance tests to see what broke.

Source

packet.PrivateKey accepts a crypto.Signer in place of an actual key, so a signature can be made by something that never exposes any key material, which is more or less the definition of a KMS.

Source

go-crypto's encrypted_key.go hard-asserts *ecdh.PrivateKey when it decrypts a PKESK packet, so there is no interface to implement, no crypto.Decrypter equivalent for ECDH, and no way to hand it a shared secret computed somewhere else.

Source

Pulling go-crypto in costs golang.org/x/crypto, github.com/cloudflare/circl and everything underneath them, and when that dependency went in during the experiment it brought eighteen CVEs along that had to be resolved by raising pins.

Source