>emerging consensus among experts Citation needed. >at best you're attempting to tunnel encrypted messaging over an unencrypted transport Like every encrypti

>emerging consensus among experts Citation needed. >at best you're attempting to tunnel encrypted messaging over an unencrypted transport Like every encryption scheme ever. >A protocol that leaks metadata They all do? At best you get to choose which provider sees it, and even then timing attacks usually make short work. >browser clients that can't meaningfully implement crypto >search that can only be delivered efficiently at scale by databases of plaintext (most likely at centralized servers). Technically, nobody uses browser clients; browsers can't talk SMTP. They use browser interfaces to cloud clients, over encrypted connections. The centralization is the main problem - you cede both security and control. Plaintext search is a weird example. That can trivially be done on a mobile phone. Why bother? Because email isn't going away. Any encryption is a strict improvement. And it's federated! No network, federated or no, comes close to email's ubiquity. Again, the main problem is the centralization to large providers. It makes it very hard to add encryption support as a protocol addon - you have to convince every provider that it's worth their while. The One True Solution is for people to start running their own mailboxes - which seems daunting, but plenty of once-sophisticated tech setups have been productized. By analogy, I use SilenceIM for encrypted text messages. This is a very similar scenario to email - federated, plethora of unencrypted clients, no handshaking. The difference is the message gets delivered straight to me instead of a server somewhere, and I am free to install a new program that knows how to handle it. Mobile phones have actually provoked a once-unexpected shift back towards native clients for things (there was a time when people were predicting that web would completely eat desktop - thankfully they've piped down now).