RPM AFAIK contains PGP signature verification code which seems to
be able to even handle the PEM/Base64 variants. So, I'm wondering
whether it would be even possible to implement the "gnupg(<path>) [=
<fingerprint>]" *WITHOUT* an external gpg(1).

The background for this is that especially with the latest GnuPG 2.x
the dependencies to install gpg(1) increased dramatically. This means
that in a self-contained environment like OpenPKG one would be able to
check "gnupg(...)" dependencies only after one has built about a dozen
packages -- this renders "gnupg(...)" mostly useless for us in practice.

But all which I'm seeking for is to be able quickly (no external program
forks) and self-contained (no external dependencies) to check the PGP
signature on a file. So, as RPM already ships with BeeCrypt based PGP
verification functionalit, would be *EASILY* possible to use this
already existing functionality?
                                       Ralf S. Engelschall
                                       rse@engelschall.com
                                       www.engelschall.com