Encryption and authentication

Hi,

I hope you'll excuse all my dar enthusiasm... I really am enjoying it
and just had a lengthy Mastodon thread about it.

Anyhow, in researching the encryption and signature options, I believe
that what I have found it this:

- The encryption itself is not authenticated (not using AEAD or some
  such)

- The signature applies only to the session key

- (And the key seems to be derived using SHA-1; not sure how important
  that is)

So it looks to me that --sign doesn't actually guarantee the integrity
of the data.

Related, does the encryption also encrypt metadata such as filename at
every occurrence?

Thanks!

- John