Mail on both OSX and iOS have native support for S/MIME, which I've been using daily for many years. You can use it to sign and/or encrypt emails. Keys are sto

Mail on both OSX and iOS have native support for S/MIME, which I've been using daily for many years. You can use it to sign and/or encrypt emails. Keys are stored in the keychain. S/MIME uses a CA-based system for authentication, so the pro is that you don't even need to do key management (it is sufficient that one user sends you a signed message - and you use the CAs to validate the signature), and the key is automatically imported into the keychain. The con of the CA-based system are the same of SSL/TLS. The only non-user-friendly pass is acquiring the certificate, which is as hard as getting a server SSL certificate; not complicated for an IT professional, but impossible for a casual user (plus, you have to pay them, unless you use StartSSL). Once the certificates are installed, the whole experience is mostly dumb-user proof. For enterprises, OSX & iOS supports pulling the certificate from a specific ActiveDomain/LDAP record, so that you can automatically send encrypted mails to anybody in the company, even if you haven't communicated to them before; moreover, they support deployment through configuration profiles, so that it gets auto-installed and auto-configured for the end user.