I am currently in a situation where using the
--clearsign flag would be impractical.
I have established via the size of a signature that it does contain some form of the input data (so when I typed
gpg --armor --sign file.txt, the output of
file.txt.asc was, on multiple occasions, minutely larger than the original file), however, when using
gpg --verify file.txt.asc, I am only able to tell that the file was signed by me, and not what it's contents are, even when using the verbose flag.
If the original data is irretrievable, then what is the point of having the signature, since all it shows is the date it was signed and who it was signed by? If I were a MITM, couldn't I just copy that signature and pretend that I'm the sender, even if the date was a little off?