I missed that part. Thanks for the correction.
Looking at the court’s opinion (PDF), it appears this case did not raise that issue. I think it’s unlikely it would be considered a bill of attainder because what it does is technically not punishment, but that’s a question for people who know more about law than I do.
I’m sad PGP didn’t become a popular way to log into websites. A challenge-response protocol could have even been built into web browsers. Big tech is reinventing that idea as Passkey, but with a very big tech flavor.