replace OpenSSL with GnuPG; use pinentry for passphrase input