Document that PGP encryption does not provide authentication

Sops uses AES-GCM that is an authentication encryption mode, providing both confidentiality and integrity/authenticity of the encrypted configuration values. That is, nobody can read them and also nobody can alter them or generate a fake configuration file. AES-GCM is used with a random data encryption key (DEK) that is then itself encrypted with either KMS or PGP/GPG.

When used with KMS (at least in the default setting) this authentication property is preserved as the DEK is both encrypted and authenticated (and optionally signed) by the KMS. This ensures that only users that were authorised to access the KMS could have encrypted that DEK.

However, for PGP encryption the DEK is only encrypted and not signed or authenticated. This means that anybody with access to the PGP public key can generate a fresh DEK, use that to encrypt a new version of the config file, and then encrypt their DEK with the public PGP key. For example: while they may not be able to read your database server credentials, they can substitute them with their own server credentials, redirecting all your data to their database.

(NB: keeping the public key(s) secret is not really a good defence here as typically public key encryption systems do not make any claim to keep public keys secret).

This should be documented to make users aware that sops doesn't provide authentication of configuration files when used in this configuration, and so users should ensure authenticity of their configuration by other means: e.g. keeping their configuration in a git repository that requires signed commits from a known set of trusted keys, or using other access controls to restrict write access to the file(s).

A possible enhancement to sops itself would be to allow a signing private key when encrypting/editing a file with PGP, and to verify the signature against a configured set of public keys when decrypting it.

No documentation file, test, or entry point is named in the issue, so first locate the user-facing documentation for PGP-encrypted files and review its existing security guidance. Document that PGP encrypts the DEK without authenticating it, explain the resulting substitution risk, and describe external authenticity controls such as signed commits or write access restrictions.