Ideally you'd generate a new keypair for each employee. Move their private key onto an OpenPGP smart card, and give them that. Then encrypt all of their incomin

Ideally you'd generate a new keypair for each employee. Move their private key onto an OpenPGP smart card, and give them that. Then encrypt all of their incoming email with their public key on the server as it comes in. In case they lose their smartcard or you need to recover their email for any other reason, keep a second copy of their key, password protected, offline, in a safe. Or alternatively encrypt all incoming email with a second master key, whos private key is offline, password protected, in a safe.