Nothing particularly interesting, and it is possible that I'm just wrong (I've never looked at S/MIME in great detail). Basically, S/MIME requires the sender to

Nothing particularly interesting, and it is possible that I'm just wrong (I've never looked at S/MIME in great detail). Basically, S/MIME requires the sender to figure out which certificate to encrypt to. I'm not aware of any method of doing such discovery that, at least on first use, is more secure than the least secure trusted CA. But in the public, internet-wide scenario envisioned by OP, "least trusted CA" means that we have the same problems as for SSL. This is not just a first-use problem, either. At least Outlook happily accepts valid-but-different-from-previously-seen certificates, and will encrypt replies to the certificate signing/encrypting the message being replied to. Thus, if I can convince BadCA to give me a certificate for thomas at matasano.com, I can send a mail "hey, $PARTNER, I'm away from my usual devices and I really need the proposal for $BIG_CUSTOMER. Could you send it to me? Please don't forget to encrypt it." Such an e-mail will appear appropriately signed, and I can read any replies $PARTNER sends. Deploying S/MIME within an organization or within a couple of mutually-trusting organizations works just fine, of course; it's only involving public CA's that causes a problem. (Or did I miss something?)