I think I'd agree with most of what you said there. I would only reiterate that the expected blast radius of leaking a single plaintext email is likely to be l

I think I'd agree with most of what you said there. I would only reiterate that the expected blast radius of leaking a single plaintext email is likely to be less than that of leaking a password/session over HTTP (assuming the user is in possession of comparably sensitive information in the two scenarios). Of course, on the modern web, the latter failure is much less likely to happen, and I accept your point that PGP encrypted email is uniquely burdened by the risks of backwards incompatibility, at least in the world of secure messaging services. It may not be a perfect comparison for me to bring up HTTPS, but I think that the incremental nature of that technological upgrade provides some helpful perspective. Also, I appreciate your restraint about what I assume is the other subject that would be a source of disagreement. There's no need to complicate matters by introducing that extra topic, and I apologise if mentioning MTA-STS was unhelpful for that reason.