You could adopt a company policy that mandates PGP for everyone as it's not that difficult to create, distribute and revoke public keys for your employees. Prob

You could adopt a company policy that mandates PGP for everyone as it's not that difficult to create, distribute and revoke public keys for your employees. Problems arise when you try to apply this process to the larger public, as that means having people self-sign their certificates for their public keys or having one user vouch for another. But that's where security breaks. Even with CAs on the internet you're never 100% sure you're talking to a legit entity; any scenario where CA aren't even present is just a nightmare that doesn't improve security by one bit. It's not just about making sure nobody except the recipient can read emails it's also about making sure that the recipient is legit, and that's the problem.