I found this particular passage of the protocol summary intriguing: "the server must verify two signatures of 'scope' which includes every detail of the transaction e.g. SWIFT, amount, currency, account number or Bitcoin address. Entire transaction is signed on both devices (usually desktop + mobile)."
The ability to subdivide authorization is one of my favorite aspects of Tarsnap, although there the delineations are both more flexible and under the control of the client instead of the server.
One thing that that gives you is the MDC packet, which isn't enabled by default in gpg classic. (Hence the parade of "message was not integrity protected" warnings.)
It can be requested directly via '--force-mdc', but, as long as you're tweaking the configuration, you might as well boost everything up to the full "Grovergeddon" settings.
https://github.com/sakurity/securelogin
The ability to subdivide authorization is one of my favorite aspects of Tarsnap, although there the delineations are both more flexible and under the control of the client instead of the server.