I think the best solution is PGP, it's more secure and is more mature - the issue is that it's a chicken and egg problem. There is no point me sending a PGP enc

I think the best solution is PGP, it's more secure and is more mature - the issue is that it's a chicken and egg problem. There is no point me sending a PGP encrypted email unless I know the person can or is willing to decrypt it. It's also not very usable for non-technical people (i.e. the people who can barely tell the difference between the Googles and the Facebooks). It would be great if a popular mail client came out that supported PGP as a first class feature [0], initially just signing messages to get awareness and support out, and then end-to-end encryption. I suspect that'll just lead to governments putting even more pressure on banning encryption though, e.g. in the UK where you can be jailed even if you legitimately forget or don't know the decryption key. [0] Google released a plugin for Gmail a couple of years ago, but I mean supporting and enabling it by default. There's also the issue of whether a web application is really secure, so an open source desktop/mobile application is a must.