Practically speaking, I expect this concern to apply mostly when users install but don't build their own emacs, plus it is likely to misfire when distributors build emacs. 

Separately, if we think this is important enough to *want* GPG/PGP/etc more often, we could ask the distros to add it as an optional dependency.

Hope that helps,

~Chad