Above post is mine, I failed to notice that I wasn't logged in. You said above that you can't guarantee that the end users have GnuPG, but you might want to see about Crypt::OpenPGP. I haven't used it myself, I don't know if it's reliable, and it hasn't been updated in years... but it claims to be a pure-perl implementation of OpenPGP. Might make a worthy alternative.