I'm going to suggest a compromise way to get wide scale email encryption rolling out: The key benefits are that (1) the user doesn't have to do anything at all

I'm going to suggest a compromise way to get wide scale email encryption rolling out: The key benefits are that (1) the user doesn't have to do anything at all and (2) it prevents mass surveillance and recording of email, but with a downside that it's not authenticated. There's significant benefit even when it's non-authenticated. These days I get email from the other side of the Earth in several seconds. So adding a few more seconds to delivery shouldn't be a deal breaker on what I'm about to suggest. Let every email client do opportunistic non-authenticated encryption with every other email client. That way, the user doesn't have to do a damn thing. Example: Alice wants to send an email to Bob. Before sending the real email, Alice's email program sends an ephemeral public-key to Bob's email program -- hoping that Bob's email will promptly reply with its own ephemeral public-key. If Alice gets a reply within, say, 20 seconds, great. They can now send encrypted but non-authenticated email to each other. If Alice receives no reply or an error message, then her email program sends the email the usual way (as plaintext). At this point, most readers will yell "man-in-the-middle attack." Bear in mind that this can be built upon and improved. The advantage is that it requires nothing at all from the user; the user might not even realize the email is being encrypted and decrypted. It requires only that the email client developers agree on the handshake mechanism. But importantly, this thwarts the problem that we're most worried about, which is mass NSA surveillance. Yes, the NSA or others can still do targeted MITM attacks, but they are unlikely to do a MITM on every email exchange. And if they did, it would be detected and provable, and result in a backlash demand for authenticated encryption. Furthermore, clandestine wholesale recording of your emails is useless because the keys are ephemeral.