Debian to shift to a modern GnuPG

> gpg-agent does not know about OpenPGP or X.509 certificates. It is only responsible for operations involving private keys. Thus direct access to gpg-agent is only rarely needed.

I had the impression that in gnupg 2.1, gpg-agent handled pretty much all operations involving private keys/certificates. (I don't know the details for public key/certificate handling.)