This is indeed a problem and the issue comes down to us using the same key to prove authenticity that we use to provide encryption which is not ideal (although it is convenient).
Our view is that it would be preferable to use PGP to only provide authentication of parties and, during perhaps an initial exchange, to agree upon a session key or more likely a passphrase that would be used for that one transaction only to encrypt communications between parties - probably using a symmetric algorithm.
Actually, you're NOT using the same key for both encryption and authentication, unless you're using an old-format key, e.g. one generated by Kleopatra.
Encryption sub-keys are separate from the primary key, used for signing/authentication. You can set a separate expiry date on the encryption sub-key, and periodically replace/destroy older sub-keys.
Messages encrypted with destroyed sub-keys cannot be decrypted by anyone, short of breaking the public key.
Nightcrawler
4096R/BBF7433B 2012-09-22 Nightcrawler <Nightcrawler@SR>
PGP Key Fingerprint = D870 C6AC CC6E 46B0 E0C7 3955 B8F1 D88E BBF7 433B
Security is a bit like religion... some things have to be taken on faith.
Where security differs from religion is that security is NOT retroactive.
Unlike Christianity, where you can come to Jesus, be 'saved' and have all
your sins washed away, with security you can adopt Tails or PGP, and be
secure from that point forward, but rest assured that your previous sins
(security failings) WILL come back to haunt you and bite you in the ass.
The original DPR is the poster child for that, right now.
Folly, thou conquerest, and I must yield!
Against stupidity the very gods Themselves
contend in vain. --Friedrich Schiller