Progress, technology and capitalism brought us here, you'd have to be dillusional to believe it will save us.
Solutions are political, diplomatic and moral.
I've asked bintray to add support for subkeys some weeks ago. No news since then, but they told me they were working on it. Problem right now is that you have to put your master gpg key on bintray to be able to sign: I wouldn't.
As soon as the subkeys are available on bintray, packages from the repo will be signed though :)
trousseau wasn't built with performance in mind: not at all. The store file is encrypted/decrypted at each operations; at least until I implement some kind of pipeline.
Two alternatives possible, whether to add a '--password' global option allowing you to provide your password at runtime, or to implement https://github.com/tmc/keyring.
What do you think?
Any other alternatives to suggest?