SMTP authentication is broken. Don't rely on it for confidentiality. There is no cert-pinning RFC for STARTTLS afaik, so stripping attacks on STARTTLS are still

SMTP authentication is broken. Don't rely on it for confidentiality. There is no cert-pinning RFC for STARTTLS afaik, so stripping attacks on STARTTLS are still possible. And, by far the most important: most of the world uses a large E-mail provider. So, if you send a mail to someone using Gmail/Yahoo Mail/Outlook, your "confidential" data is leaked. And don't forget metadata leakage. Metadata is by far more interesting for the NSA than then the content of your mails. I use Gmail + GPG (almost nobody uses GPG) in Thunderbird. When I truly need confidentiality over internet communication, I use Signal. SMTP is just plain broken in a sense of security.