That's the point. If you have to "setup the environment correctly" you should implement a native client. GPG is secure because it transfers data...not code. That's actually the webs biggest problem...you can't trust code given to you by some stranger. If you transfer data you can verify that it hasn't been modified in transit. Its really impossible to verify that code given to you performs the way that you think it will.