With "Johnny you're fired", it's clear that many clients don't correctly validate PGP signatures
I don't really know what concrete advice the article gives for me personally. (The only thing I take away from this is to learn libsodium as well, rather than not using PGP.)