We can't expect the general public to be very good at security. I gave up on PGP, and most of my clients and I don't have an e2e encrypted chat or password man

We can't expect the general public to be very good at security. I gave up on PGP, and most of my clients and I don't have an e2e encrypted chat or password manager service in common. But at least I tell them to use a "burn after reading" post on an encrypted pastebin like 0bin.net for the secrets thing to send me. It adds almost no complexity, best case scenario, you increase the security against bots since they would need to parse the link, visit the paste, trigger the Burn After Reading feature, interpret JS, extract the password and use it. That's already a pretty specific bot. Most interceptions, even human, will be detected thanks to the burn after reading. And the password is never stored in the pastebin db since it's encrypted client side. Worst case scenario, it's the same than a plain text email. Not much to loose. It's easy to teach. Requires no install, little skill or tech, works in most corporate setup. It's not good security. But it's better than abysmal security.