Hello all,

Thank you for gpg2!

I have the following usecase:

1. encrypt file.txt to file.txt.gpg
2. sign file.txt to file.txt.sig
3. upload file.txt.gpg and file.txt.sig to UNSECURE CLOUD

Now I have the possibility to --decrypt file.txt.sig from the unsecure cloud environment!

I propose to change the default in step 2) to a --detach --sign and possibly create a new --attach --sign as the optional feature!

Otherwise it is easily possible to compromise file.txt with distributing the created signature!

Thanks for considering!

Ciao
Gerrit