armor
use-agent
utf8-strings
charset utf-8
display-charset utf-8
homedir ~/.config/gnupg
list-options show-photos

# use sks-keyservers.net over https
keyserver hkps.pool.sks-keyservers.net
keyserver-options ca-cert-file=~/.config/gnupg/sks-keyservers.netCA.pem

# don't honor the keyserver url a key specifies;
# always use sks-keyservers.net over https
keyserver-options no-honor-keyserver-url

# use the local keyring, DNS, and keyservers to auto-locate keys
auto-key-locate local,cert,pka,keyserver
keyserver-options honor-pka-record,auto-key-retrieve
verify-options show-keyserver-urls,pka-lookups

# always encrypt things to my own key, too.
encrypt-to 3A9D0BB5

# when outputting certificates, view user IDs distinctly from keys:
fixed-list-mode

# short-keyids are trivially spoofed; it's easy to create a long-keyid collision;
# if you care about strong key identifiers, you always want to see the fingerprint:
keyid-format 0xlong
with-fingerprint

# when multiple digests are supported by all recipients, choose the strongest one:
personal-digest-preferences SHA512 SHA384 SHA256 SHA224

# preferences chosen for new keys should prioritize stronger algorithms: 
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 BZIP2 ZLIB ZIP Uncompressed

# You should always know at a glance which User IDs gpg thinks are legitimately bound to the keys in your keyring:
verify-options show-uid-validity
list-options show-uid-validity

# when making an OpenPGP certification, use a stronger digest than the default SHA1:
cert-digest-algo SHA512

# don't include the gpg version in the ASCII armored output
no-emit-version