> For example, rather than gpg, which is in itself complex, could it use something else?
It's not too bad to set up.
It takes about a minute to generate a gpg key pair minus the time it takes to generate a 4096 bit rsa key.
I made a video (and cheatsheet) the other week going through the process of creating a gpg key pair with an expiration date, how to export / import, revoke and backup your keys at https://nickjanetakis.com/blog/creating-and-managing-a-gpg-k....
It's totally worth it, I've been using pass for like 4 years and have hundreds of passwords in it. It works great. Also having a gpg key pair is handy to have around if you want to sign your git commits.