Comment 2 for bug 612998

FWIW, this bug effectively disables GPG signature verification, since GPG output (of any kind) can't be parsed by the code shipped in 1.0.40.

Thus, one could regarding this as a security bug, but that depends upon how one regards asdf-install and / or GPG check. Not mine to say, and the workaround is very easy...and very non-blocking.