Here's what he's using it for: http://vulnarb.com/ http://vulnarb.com/ It's not for communicating with web developers. It's for publicly and provably, but res

Here's what he's using it for: http://vulnarb.com/ http://vulnarb.com/ It's not for communicating with web developers. It's for publicly and provably, but responsibly exposing vulnerabilities in software. The people/entities who write such software are likely to have a public website with SSL. If they don't, it's unlikely to be very important or widely used software. In that context, PGP makes no sense.