--libexecdir=/usr/lib: This command creates a gnupg directory in /usr/lib instead of /usr/libexec. chmod 4755 /usr/bin/gpg: We install gpg setuid root to avoid swapping out of sensitive data.