Package: spamassassin Version: 3.4.1-6 README.debian states: Note that sa-update requires gnupg 1.x in order to function. Because the sa-update functionality is optional, the gnupg package is listed as a "Recommends" for spamassassin
But the package recommendation of gnupg is for gnupg 2.1.17-2. If it does depend on gnupg 1.x, not 1 or later or something, it would recommend the gnupg1 package.