I think you are discounting the level of thought and care that went into this. Meh, fail.

The level of care and thought put into creating a secure encryption scheme doesn't matter if the cryptography is broken. There's a reason you constantly hear cryptographers telling everyone to never invent their own crypto-systems; it's extremely difficult to do right.

so copy pasting PGP is somehow getting it right?

Parent made no mention of PGP, only that care and thought are meaningless if the crypto is flawed, which from the looks of some of the more knowledgable commenters, is the case.

It's understandable that you have a personal obligation to defend your friend, but it really isn't necessary. Sit back, relax, and allow the author to reflect on the constructive feedback here.