The mention of GPG-encrypted email in my above comment is actually wrong: even GPG generates a symmetric key, encrypts that with the public key of each recipien

The mention of GPG-encrypted email in my above comment is actually wrong: even GPG generates a symmetric key, encrypts that with the public key of each recipient, and encrypts the actual message content with the symmetric key. As well as improving performance, it makes it possible for each recipient that a message was encrypted to, to be sure that the other recipients received the same message. https://security.stackexchange.com/questions/74412/why-is-gpg-encrypted-message-size-not-proportional-to-number-of-recipients-fil https://security.stackexchange.com/questions/74412/why-is-gp... has a demonstration: echo 'foo' | gpg --recipient a4ff2279 --recipient d745722b --encrypt | LANG=C pgpdump Old: Public-Key Encrypted Session Key Packet(tag 1)(524 bytes) New version(3) Key ID - 0xCC73B287A4388025 Pub alg - RSA Encrypt or Sign(pub 1) RSA m^e mod n(4093 bits) - ... -> m = sym alg(1 byte) + checksum(2 bytes) + PKCS-1 block type 02 Old: Public-Key Encrypted Session Key Packet(tag 1)(268 bytes) New version(3) Key ID - 0xDAA855623A5E68F7 Pub alg - RSA Encrypt or Sign(pub 1) RSA m^e mod n(2046 bits) - ... -> m = sym alg(1 byte) + checksum(2 bytes) + PKCS-1 block type 02 New: Symmetrically Encrypted and MDC Packet(tag 18)(63 bytes) Ver 1 Encrypted data [sym alg is specified in pub-key encrypted session key] (plain text + MDC SHA1(20 bytes))