This is addressed in the blog post: "There are obvious caveats to this solution though. If somebody gets root on my server or access to the network, they can s

This is addressed in the blog post: "There are obvious caveats to this solution though. If somebody gets root on my server or access to the network, they can sniff the emails on the way in before they're encrypted. This wont help them access historical email which was encrypted before they started though. Also, if somebody installs a trojan on my laptop it's game over; they can grab my private PGP key, and use a keylogger to get the password for the key." There is no "perfect" solution. There will always be attack vectors. I just removed a few. Specifically, compromising my email account, or compromising one of my clients (in certain ways).