yeah that gets clear when they talk about their certified physical security: there is a strong assumption that drives can not be stolen and will be destroyed at

yeah that gets clear when they talk about their certified physical security: there is a strong assumption that drives can not be stolen and will be destroyed at their EOL. Such assumptions often don't hold. Encryption and physical protection are not redundant, they are defense in depth. I agree with the GPG part and that a mail provider can not reasonably create something similar, however they have a weird understanding of "encryption at rest" at the base of their argument why they don't do it.