To make sure that mutt never invokes gpg. I still found (with ktrace) it calling the pgp_decrypt_command hence setting it to false. This is a PSA in light of: https://www.eff.org/deeplinks/2018/05/attention-pgp-users-new-vulnerabilities-require-you-take-action-now