That's true. I guess we need something like https://en.wikipedia.org/wiki/Extended_Validation_Certificate https://en.wikipedia.org/wiki/Extended_Validation_Cert

That's true. I guess we need something like https://en.wikipedia.org/wiki/Extended_Validation_Certificate https://en.wikipedia.org/wiki/Extended_Validation_Certificat... for email then. I'm not sure how PGP would help though, as the user also has to check, if the email from his bank was signed with the correct key. Checking the exact domain name is something he can already do and I guess is also easier to understand.