>The rule is, "data in motion should be secured with TLS, data at rest should be secured with PGP". No. The rule is, "ask people who know about security and cr

>The rule is, "data in motion should be secured with TLS, data at rest should be secured with PGP". No. The rule is, "ask people who know about security and cryptography to help you solve your problem". That's what we do, and I can tell you that our guidelines are much more complex than simply using TLS or PGP. Actually I think we don't really have guidelines. It's very easy to use TLS and PGP the wrong way.