PGP messages created using Keybase leak version information

Creating a PGP encrypted messages using Keybase (both the client software and using the web form at http://keybase.io/encrypt) results in a message that includes the software version used to create the message.

For example:

-----BEGIN PGP MESSAGE-----
Version: Keybase OpenPGP v2.0.55
Comment: https://keybase.io/crypto

etc.

or

-----BEGIN PGP MESSAGE-----
Comment: https://keybase.io/download
Version: Keybase Go 1.0.16 (windows)

etc.

This is not a security issue by itself, but it gives potential attackers more information about the software used to create the message. If an attacker has both an encrypted message and knows of vulnerabilities/defects in specific client software versions (or if a flaw is discovered at a later time), it may aid the attacker in recovering the plaintext.

The version string and comments can be disabled in GnuPG with the no-emit-version and no-comments options, respectively.

I understand it is desirable to include the comment pointing to Keybase in order to decrypt messages they receive, but it would be best to omit the specific software version used to create the message.

Start by reproducing the armored PGP output with the Keybase client and web form, then trace where the version and comment headers are added. Done means generated messages no longer expose the specific software version while preserving the desired Keybase comment behavior.