[attila-lendvai]

signing and encryption are separate operations also in PGP.

and yes, one of the hardest parts of this domain is the implementation of the web of trust (key management).