move crypto data into an annotation structure, and fix pgp/inline

note that we currently lack proper confirmation about whether data was
actually decrypted or not, so for now we always assume it wasn't