The PGP 2.6.2 code is disgusting, and should not be integrated directly into any mailer application. The 3.0 code will be modular and based on published interfaces. Furthermore, the 3.0 development team plans to release the code as both a stand-alone application and as a library. It is difficult to predict when the official release will happen. Based on what I've seen, fall of 1996 seems the most likely.
MOSS is mostly cryptographically sound.
Thus, it cannot be said that MOSS is in accordance with the recommendations for minimum keysize. In this way, it is a dramatic advance over PEM, which only supported X.509, but life for implementors remains hard. One feature which I believe is sorely lacking is a cryptographic hash of the public key as the basic unit of manual key management. Thus, people either have to trust the mechanism by which the key was delivered, or examine the base-64 representation of the entire key. I consider this to be a serious usability problem.