Is there any point to encrypting a file if it's transferred via ssh? Suppose I have two machines which can ssh into each other. Is there very little point in using gpg with a password protected symmetric cipher to transfer a sensitive file, and going to the effort of sharing the password - over, say, an encrypted call?

I realize that theoretically the ssh communication could be compromised without the password which protects the encrypted file being compromised, but what I'm asking is does the whole system need an overhaul if I'm leaning on ssh being secure for sensitive file transfer?
If you had a system like this:

\begin{equation}
  \text{you} \longleftrightarrow \text{your network} \longleftrightarrow \text{shared host} \longleftrightarrow \text{friend's network} \longleftrightarrow \text{friend}
\end{equation}


Your use of ssh defends against an eavesdropper or forger on your network.
Your friend's use of ssh—if your friend is using ssh instead of, oh, I dunno, rlogin or rcp—defends against an eavesdropper or forger on your friend's network.
The use of gpg with a password transmitted out-of-band to encrypt the file defends against an eavesdropper—but not a forger!—on the shared host.


Why no defense against a forger on the shared host?  Nobody bothered to teach OpenPGP about symmetric authenticated encryption.  You could use the scrypt(1) utility instead, which does use authenticated encryption.

How could there possibly be an eavesdropper on the shared host?  The eavesdropper might come in the form of the administrator of the VPS you're using for your shared host, who has access to the raw disk.  The eavesdropper might come in the form of an automatic backup system which persists the file much longer than you intended.

But, on a more careful reading of the first eleven words you actually wrote, I see that you actually have a system like this:

\begin{equation}
  \text{your machine} \longleftrightarrow \text{internet} \longleftrightarrow \text{friend's machine}
\end{equation}

Conceivably you might have different applications and daemons running with different privileges, and your user account on your friend's machine might be more vulnerable than your friend's user account.

But there's not much else that gpg adds beyond (a) a hedge against bugs in ssh or breakthroughs in breaking DH (like a network eavesdropper with a quantum computer) that don't apply to your out-of-band channel, and (b) a usability nightmare.