A recent thread suggests that you should not necessarily trust GnuPG, but at least the thread provides a fix so that the package actually compiles.