I thinnk PGP can't have a widespread adoption on its own. We need to piggy-back it on another network of trust. Here's a scheme for such an application: - By

I thinnk PGP can't have a widespread adoption on its own. We need to piggy-back it on another network of trust. Here's a scheme for such an application: - By default, if the person you're communicating with is not in the network, you're out of luck. Maybe send a message along these lines: "I'd like to communicate with you but you don't have a secretcommunication key. Could you please create one so we can have some privacy ?" - On first launch, you create a PGP pair and send the public key to networks you trust: Facebook, G+, HN, reddit, whatever. By "trust" I mean "you trust the network to give you the correct identity of your contacts": you've befriended that Maria on Facebook, so you can trust it to give you the correct public key that Maria created on her machine - When you want to send an email to maria, your application fetches the public key on either network (if it doesn't have it already) and uses it to encrypt your communication. Note that the application MUST NOT sign the identity for you; it should just raise no warning. It MUST always be up to the user to sign these. In a very broad sense, that's what keybase.io is doing: instead of being yet another provider of trust, it re-uses the trust you have already built in other networks. The number 1 problem to tackle is make sure anyone who wants to create an account will also create a PGP key.