Comment by mirimir

The Ars article ends with:

    "A real audit of the [GnuPG] code would be great," Green said. "The problem
    is it would be really expensive and I'm not sure it's worth it."

I wonder what Green means as the alternative to auditing the GnuPG code. Doing nothing? Or could he be arguing that it would be better to start from scratch? Is there a replacement in the wings? Or even as a glint in someone's eye?