While theoretically the case... perhaps if real security people reporting real issues were to use GPG, there'd be an incentive to set it up properly. In practic

While theoretically the case... perhaps if real security people reporting real issues were to use GPG, there'd be an incentive to set it up properly. In practice, if 99% of emails you get via GPG are no better than spam - and in fact worse, since they require that you waste your time figuring out whether there is actually a bug - then GPG mostly just makes for a pretty good spam filter. Back in the real world, most security-minded people realise there's little chance that anything particularly awful is going to happen as a result of sending the report as an unencrypted email, and GPG is pretty dreadful to use so next to nobody uses it except for hobbyists.