GnuPG is the main free implementation of OpenPGP. You generate a key pair, then encrypt or sign files and email so only the holder of the matching key can prove or open them. It runs everywhere. Thunderbird can do basic OpenPGP without a separate GnuPG install. Plugins exist for other mail programs.
Key management is the product and the problem. People lose the private key, forget which subkey expired, or trust a key they never checked. A signature only means “someone with this key.” It does not mean you know who that was. For one file to one person, age is simpler. GnuPG still matters for email and for software signatures you will meet in the wild.
Use it when the other person already has an OpenPGP key. gnupg.org
GnuPG signatures on software downloads are the skill worth having even if you never encrypt email. A signature file next to an installer is useless if you never fetched the signing key from a place you trust. For email, start with one correspondent and Thunderbird’s built-in OpenPGP before you build a keysigning habit. Publish a key only when you can keep the private half offline and backed up. An expired key you cannot revoke is a mess you made in public.
