Why Cleartext Signatures in PGP/GnuPG Are Problematic and Should Be Avoided

Summary

This article argues that cleartext signatures in PGP/GnuPG are a flawed and dangerous feature that should be avoided. It explains how cleartext signatures work, the problems they introduce (such as line-ending normalization issues, trailing whitespace problems, and ambiguity in signed content), and why they remain in use despite these issues. The author provides technical examples of how cleartext signatures can lead to verification failures or security misunderstandings, and recommends using detached signatures or inline signing instead.