{
  config,
  lib,
  pkgs,
  inputs,
  ...
}: {
  # install keys into gpg keyring
  programs.gpg = {
    enable = true;

    publicKeys =
      map (path: {
        source = path;
        trust = 5;
      })
      inputs.self.lib.gpgKeys;
  };

  # global gpg agent
  services.gpg-agent = {
    enable = true;
    enableExtraSocket = true;
    enableSshSupport = true;
    pinentry.package = pkgs.pinentry-curses;
  };
}