Forward secrecy isn't really an issue with email. There are few that would be willing to delete their emails after reading them. Keeping old messages around for

Forward secrecy isn't really an issue with email. There are few that would be willing to delete their emails after reading them. Keeping old messages around for all practical purposes negates the value of forward secrecy. Most people like to keep their old messages in an easily accessible form so forward secrecy is not very important for messaging in general. >...metadata secrecy... This is not a huge problem with a medium like email where you can be more or less anonymous. Contrast with things like instant messengers that insist on a phone number. >But it provides a strictly lesser degree of secrecy than modern e2ee messaging applications. Most of those applications take the form of instant messengers. Since such things by necessity have to leave the private key material exposed all the time they are generally less secure than something like encrypted email where that key material can be kept very locked down. >...modern SMTP-TLS (which is not e2ee, but does provide some metadata confidentiality and forward secrecy) may in fact be an improvement over PGP. True enough. SMTP-TLS does provide even more security to the encrypted email user. Most importantly, it prevents passive listeners from detecting that an email was encrypted and thus worthy of further interest. I can't help but point out that this sort of discussion is an excellent example of the state of denial that exists with respect to end to end encrypted messaging these days. Rather than addressing the broader overall issues we are quibbling about obscure technical details.