I've setup okular signing and it worked, but I believe it was with a mime certificate tied to my email (and not pgp keys). If you want I can try to figure out exactly what I did to make it work.
Briefly off the top of my head, I believe it was
- Getting a mime certificate for my email from an authority that provides them. There's one Italian company that will do this for any email for free.
- Converting the mime certificate to some other format
- Importing the certificate to Thunderbird's (or maybe it was Firefox's) certificate store (and as a sidequest setting up Thunderbird to sign email with that certificate
- Telling Okular to use the Thunderbird/Firefox certificate store as the place to find certificates
I can't remember if there was a way to do this with pgp certificates easily
You definitely use a firewall, but there's no need for NAT in almost all cases with ipv6. But even with a firewall, p2p becomes easier even if you still have to do firewall hole punching