Implement embedded OpenPGP compatibility (#4)

DEPENDENCIES.md

@@ -1,7 +1,8 @@
 # Dependency and license review
 
-Reviewed 2026-08-09. The project license remains intentionally unset until the
-GPG compatibility spike is complete.
+Reviewed 2026-08-09. The OpenPGP backend decision is complete. The project
+license remains intentionally unset pending the full transitive license audit
+and packaging review described below.
 
 ## License direction
 
@@ -17,6 +18,8 @@ The current direct dependencies are:
 | [crossterm 0.29](https://crates.io/crates/crossterm/0.29.0) | Terminal I/O | MIT |
 | [Ratatui 0.30](https://crates.io/crates/ratatui/0.30.2) | TUI | MIT |
 | [Iced 0.14](https://crates.io/crates/iced/0.14.0) | Desktop UI | MIT |
+| [pgp 0.20](https://crates.io/crates/pgp/0.20.0) | Embedded OpenPGP key import, encryption, decryption, and signatures | MIT OR Apache-2.0 |
+| [rand 0.8](https://crates.io/crates/rand/0.8.7) | Operating-system-backed cryptographic randomness for OpenPGP operations | MIT OR Apache-2.0 |
 | [Serde 1](https://crates.io/crates/serde), [TOML 0.9](https://crates.io/crates/toml), [shlex 1.3](https://crates.io/crates/shlex), [url 2.5](https://crates.io/crates/url) | Strict configuration and command values | MIT OR Apache-2.0 |
 | [UniFFI 0.32](https://crates.io/crates/uniffi/0.32.0) | Swift bridge | MPL-2.0 |
 | [zeroize 1.9](https://crates.io/crates/zeroize/1.9.0) | Clear decrypted bytes on drop | MIT OR Apache-2.0 |
@@ -35,7 +38,7 @@ decision.
 
 | Slice | Candidate | License | Decision |
 | --- | --- | --- | --- |
-| GPG-compatible packets, encryption, and transferable keys | [`pgp` 0.20](https://crates.io/crates/pgp/0.20.0) | MIT OR Apache-2.0 | Preferred; pure Rust, including its default Rust bzip2 backend. Prove interoperability with GPG-produced fixtures first. |
+| GPG-compatible packets, encryption, and transferable keys | [`pgp` 0.20](https://crates.io/crates/pgp/0.20.0) | MIT OR Apache-2.0 | Selected with default features disabled. The fixture harness proves armored/binary protected key import, packet validation, GPG-compatible decryption, multi-recipient encryption, and detached signatures without native libraries or processes. |
 | Alternative GPG implementation | [`sequoia-openpgp` 2.4](https://crates.io/crates/sequoia-openpgp/2.4.1) | LGPL-2.0-or-later | Hold in reserve. Its default Nettle backend is native; its Rust backend exists, but the LGPL adds distribution work we can avoid. |
 | GnuPG integration | [`gpgme` 0.11](https://crates.io/crates/gpgme/0.11.0) | LGPL-2.1 | Reject: native GPGME/GnuPG integration and GPG engine processes violate the portability and no-process requirements. |
 | Local Git plus HTTPS fetch/push | [`gix` 0.86](https://crates.io/crates/gix/0.86.0) | MIT OR Apache-2.0 | Preferred with default features off and `blocking-http-transport-reqwest-rust-tls`; accept HTTPS remotes only and supply credentials directly. |
@@ -55,8 +58,11 @@ Linux Secret Service, and Apple camera APIs remain operating-system boundaries.
 
 Before choosing and adding the project license:
 
-1. Prove `pgp` can decrypt, encrypt, re-encrypt, and round-trip representative
-   GPG files and exported keys from real `pass` stores.
-2. Lock the storage dependencies and run a full transitive license audit.
-3. Confirm the required notices/source offers for MPL-2.0 dependencies in every
+1. Lock the storage dependencies and run a full transitive license audit.
+2. Confirm the required notices/source offers for MPL-2.0 dependencies in every
    distributed app package.
+
+The checked-in compatibility suite completes the earlier OpenPGP backend gate:
+`pgp` imports protected armored and binary exports, decrypts every GnuPG-audited
+fixture, emits independently decryptable single- and multi-recipient messages,
+and verifies the detached recipient signatures.