Parent made no mention of PGP, only that care and thought are meaningless if the crypto is flawed, which from the looks of some of the more knowledgable commenters, is the case.

It's understandable that you have a personal obligation to defend your friend, but it really isn't necessary. Sit back, relax, and allow the author to reflect on the constructive feedback here.