Mentat

• use a Python library (probably https://pypi.org/project/python-gnupg)
• use GPG from the system

I like the former way using Python library, but it will bring another dependency.

Took a look. python-gnupg is quite extensive wrapper around gnupg binary (key generation, trust setting, keyring management, ...) It won't help with GPG/MIME, with signature attachment construction at all. The only thing we would use from this library is probably GPG.encrypt_file, which is just something akin to Popen("gnupg --clearsign --default-key ...), and all the base64/mime logic is still on us.