The RNP library we use to perform signature verification of PGP signatures requires either openSSL or botan crypto backends. Windows platforms do not vendor in openssl. Historically, we avoided vendoring in openssl to prevent having to perform a mongodb upgrade to bump the openssl library when security vulnerabilities are detected in the library.

To support this, we’ll either need to vendor in openssl (undesirable), or use built in windows functionality for signature verification (i.e Authenticode).