The default behavior of Crostini’s Debian Stretch container is to use a curses-based pinentry. This behaves strangely, in two different ways:
Inherently, it shows the semi-graphical pinentry dialog in the terminal that has last called
gpg-connect-agent updatestartuptty /bye. You can do this in
.bashrc or similar, but if your habit is (like mine) to run many different terminals at once, you would need to call this whenever focus changes – otherwise the pinentry dialog will invariably come up in a random terminal. Of course this might still be inconvenient if pinentry is triggered from a UI application instead of on the console.
If the pinentry dialog comes up in a terminal other than the one where the gpg process originated, it doesn’t work correctly anyway – the dialog is drawn on screen, but the command prompt (or whatever is running) remains active in the background and grabs input. I didn’t investigate this any further.
The VPN setup pages in Chrome OS appear to support OpenVPN. ProtonVPN also supports OpenVPN connections, and configuration files are available for download. However, it turns out that OpenVPN doesn’t actually work with Chromebooks quite as easily as it should – long discussions are easily found, solutions not so much. One of the main issues is that the visual configuration dialogs don’t support all the options OpenVPN offers, and which are used by configuration files such as those supplied by ProtonVPN and other VPN providers. The Chromium project has its own format called ONC, but OpenVPN configuration files end in