The important question is whether a country has jurisdiction over services rendered remotely. Is every website accessed by a Brazilian person required to follow Brazilian law?

If a Brazilian uses GPG is the author required to provide the Brazilian government a method of decryption? Are they required to take measures preventing Brazilians from acquiring the software?