To be fair, naively and given the use case you described, that sounds to me like in this particular instance they are trying to ensure that the encryption being used is "secure enough" for the govt. rather than "not too secure". It just so happens that the bureaucracy's definition of "secure enough" is a keyword whitelist that happens to have 'RSA' there and not 'PGP'.