Whether you need PGP
The statement: you have to use PGP. For some things there is no substitute. For others it adds nothing and people who are told always end up doing it badly.
Bucket: DEPENDS
It depends on the step. Encrypting something only one party should read, yes. Checking a signed announcement, yes if you already hold the key. Proving who you are to a stranger who just appeared, it will not help.
Step by step
| Step | Does PGP help |
|---|---|
| Sending an address or details to a vendor | Yes, this is the core case |
| Checking an announcement against a key you already had | Yes |
| Checking an announcement against a key from the same message | No, it proves nothing |
| Logging in | Only where the site uses a key challenge |
| Convincing a stranger you are legitimate | No |
| Verifying an onion address | No, the address verifies itself |
The case where it matters most
Anything you would not want stored in plain text on somebody else's machine. Encrypting it means the message is readable only by the holder of the matching private key, whatever happens to the machine it passed through.
The value there does not depend on trusting anyone. It depends on the maths and on the key being the right key, which is the part people skip.
The case where it is theatre
A signature checked against a key that arrived with it. That verifies, and it establishes only that whoever wrote the message also made the key. Anybody can do both in a minute. See what a signature proves for the boundary.
Signature checking is only meaningful when the key came from a different source at a different time. Where the key came from is the entire question and it is not a cryptographic one.
What people get wrong
Told always, they do it as a ritual. Keys generated in a hurry, private keys stored next to the software, passphrases skipped, keys accepted from whoever offered one. A ritual with the right shape and none of the properties.
The more common failure is quieter. Encrypting the message and then repeating the same information in an unencrypted field, or in a note, or in a follow up. The protection is only as good as the leakiest copy.
The one time cost
Setting it up properly is an afternoon. Generating a keypair you understand, storing the private key somewhere sensible, setting a passphrase you will actually remember, and practising encrypting and decrypting something harmless before it matters.
People skip the practice, which is where every real problem shows up. Discovering that you cannot decrypt your own message is much better on a Sunday than in the middle of something.
The honest position
Learn it properly if you are going to use it for anything that matters, and then use it for the steps where it does something. Doing it badly everywhere is worse than doing it well in two places, because it produces confidence without the property that would justify the confidence.
Questions people actually ask
Do I need PGP to check an awazon onion link?
No. The address verifies itself because the address is the key. PGP adds nothing to that check.
A message came with a key attached and the signature checks out. Is that good?
It proves the writer made both. It does not tell you who they are. A key is only useful if you already had it from somewhere else.