{
  config,
  pkgs,
  ...
}: {
  # install keys into gpg keyring
  programs.gpg = {
    enable = true;
    homedir = "${config.xdg.dataHome}/gnupg";

    # TODO: only import keys once
    #publicKeys =
    #  map (path: {
    #    source = path;
    #    trust = 5;
    #  })
    #  inputs.self.lib.gpgKeys;
  };

  # global gpg agent
  services.gpg-agent = {
    enable = true;
    enableExtraSocket = true;
    enableSshSupport = true;
    pinentry.package = pkgs.pinentry-curses;
    enableZshIntegration = false;
  };
}