Remove gpg-suite

[ckundo]

Hey friends, researchers have found a vulnerability that prompted EFF to make this recommendation:

Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email. Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email.

https://www.eff.org/deeplinks/2018/05/attention-pgp-users-new-vulnerabilities-require-you-take-action-now

The laptop script includes gpg-suite. From what I can tell, gpg-suite autodecrypts emails by default.

[croaky]

The laptop script includes the Homebrew gpg-suite cask
so that the ASDF version manager can check Node.js downloads
against OpenPGP signatures from the Node release team.

The current recommendation in https://github.com/asdf-vm/asdf-nodejs
is to use the gpg Homebrew package.

Since this vulnerability only applies to users of PGP email,
maybe the simplest thing is to update the Homebrew package
and not worry about this vulnerability (which is also ~1y old,
probably received some patches)?

Alternatively, a change could remove gpg-suite
and disable signature verification for Node:

- bash "$HOME/.asdf/plugins/nodejs/bin/import-release-team-keyring"
+ export NODEJS_CHECK_SIGNATURES=no

That approach recognizes that key management and signature
verification adds extra complication and opportunity for errors.

Perhaps a simpler method could one day be used for Node packages:
https://blog.gtank.cc/modern-alternatives-to-pgp/