Firstly, it's a domestic intelligence agency any laws passed are applicable to only the U.S.

Data sent over TOR is encrypted, however, LE has used exploits in the past to decrypt that information & jump between nodes which is how they've caught the high profile hackers, darknet market admins etc. This can typically be avoided by the server host patching frequently and using high encryption standards.

So the issue here is if your information is gained, it can be tracked back easily to KYC (internet service provider) and the person paying for the bill could get a knock on the door.

Now if you add a "GOOD" VPN i.e one that doesn't store logs, one that allows TOR over VPN, High standard of encryption, Not in Five Eyes Countries, Anonymous payment etc.

Then it adds an extra layer of encryption and anonymity. Remember to never communicate in plain text any information that could give away your identity. Which is why EVERYONE should be encrypting their buyer notes.

Lastly, PGP encryption is incredibly secure. However, it's actually very easy to dictionary/brute-force crack your password. I demonstrated it with one of my friends and it took me under an hour and that wasn't with dedicated GPU's.

If your password is less than 60 bits of entropy then you should probably look at changing it ASAP. It's funny because we've taught ourselves how to pick passwords that are difficult for humans to remember but very easy for computers to guess.

The password should be unique At least 9 characters long Passphrase over password and use words that you can remember but the more uncommon the better i.e "unsubmerging nonformidability goddamnit anulus"

Now if you chuck a few symbols into the above passphrase even if they're using a dictionary attack assuming a 4-word passphrase it'd take them decades to crack it.

Now even if you follow the above, if your system has been compromised then you're screwed which is why I advocate for copy/pasting the passphrase instead of using the keyboard.

Now it can be really difficult to remember unique passwords for every website/account. I recommend having a secure password manager then you only ever have to create/remember one strong password.