Yes, it is. But that's a fault of the tool, not a fault of the world; while many of these problems are very difficult, and solutions are not easy to come by, some of them we do have good strategies for. And even for GPG itself, it could be far more forgiving than it is. Without fundamentally changing the protocol, we could eliminate a large portion of GPGs configurability, and streamline it to make the "correct" choices. We as a tech industry are slowly coming around to the idea that secure systems are ones with less choices, not more.