I don't need "modern alternatives" to things that aren't broken. I'm not interested in replacing my one tool with N others when I understand my threat model and understand the benefits of my existing, battle-tested tooling.
The opening paragraph is off-putting:
> Did your last Yubikey just break?
Is this supposed to imply that I'm not supposed to be inconvenienced by my security token breaking? Of course I am. I've lost and misplaced my Nitrokey on numerous occasions, leaving me completely locked out of my systems without physical access. That's a feature, and that's intended.
> Perhaps you forgot an offline backup password.
What does that have to do with PGP?
> Maybe you're just tired of living like a spy and never using smartphones.
That absolutely has nothing to do with PGP.
> Linux distributions and many other software update mechanisms use PGP signatures to prevent malicious mirrors or network attackers from altering the contents of their packages.
GnuPG's use here is hidden from the user by the package manager. Most users have no idea it's using PGP, and don't understand what it is. They work through a package manager's abstractions. If you replaced PGP with something else, the user would likely be none the wiser. Why does it matter? Also, why do I want to abandon a keyring?
For manually verifying signatures: why does the weight of the tool matter? Is `gpgv' (which is probably already installed on your system) really weighing you down that much? Tools like signify emphasize keysize and speed compared to RSA. Do you _really_ notice as a user? Is that _really_ the bottleneck for what you're doing? It might be, but I suspect for your average user, it's not.
> I wrote one as a party trick last month – it's less than 200 lines of code and that includes some silly key parsing tricks.
Are we worried about attack surface? GPG is heavily audited---you're far more likely to be pwned through one of the 100s of other poorly audited programs on your computer. And in any case, I don't care how easy it is to write---leave the crypto to the experts. An easy-to-understand implementation is great and certainly preferred where possible, but that's only part of the battle. And tools like GnuPG already have their implementations written and audited by numerous parties over the years. That doesn't mean they're bug-free, but it's not like we're starting from scratch here.
> Original need: You want to store individual pieces of data without making their contents accessible to anyone else on your system.
I'm not arguing against the use of other programs, but I see nothing wrong with GnuPG (or PGP) for this. Again, it's a widely supported tool that's probably already available on your system, and it probably came with your distribution image, so it probably can also be trusted. Directing users to install programs is a risk in its own unless it can be authenticated through the distribution's package manager---users must understand how to verify the program themselves otherwise.
Using GnuPG also gives you some other benefits for free, like support for a smartcard, even over SSH. (You should generally prefer symmetric algorithms for long-term secrets, but if you know your threat model, or have secrets that are easily changed or don't need to stay secret long term, asymmetric may be a fine choice for you if you gain the benefit of a security token.)
> Original need: You have files that you want to send to another person, but you don't want the data to be visible in transit or stored in the cloud. For this, folks often attach an encrypted ZIP file to an email.
> Modern alternative: magic-wormhole.
This works out great (or a tool like OnionShare) if it actually addresses your problem. But what if I want to encrypt files to N people who may be online at different times, and store that file somewhere? What if I _do_ actually want to communicate over email? I happen to do most of my communication with online communities via email.
PGP does suffer from many legitimate issues, like forward secrecy. Certainly use the right tool for the job. I'm not going to use PGP as an alternative to OMEMO, for example---they're fundamentally different.
Things that certain people see as weaknesses, like logistical issues surrounding the establishment and maintenance of a web of trust, aren't weaknesses to others. I have no problem with people suggesting useful tools for certain tasks. But I'm frustrated by the FUD around PGP, as if it's insufficient for any job. It does work, it is battle-tested, and it is trusted.