You have to ask yourself a key (no pun intended) question: Why would a bank sign an email? Assume for a moment the bank actually wants to email its customers (

You have to ask yourself a key (no pun intended) question: Why would a bank sign an email? Assume for a moment the bank actually wants to email its customers (and leave confidentiality aside). That means the bank will want its customers to trust the signature on the email. Which means that the bank will want the email client to have an appropriate public key to verify the email signature. Regardless of whether we assume the email client is a browser or desktop app, this is where we enter the world of hurt, the world of wasted money. For this to work perfectly, the user has to have one or a small number of public keys installed - otherwise, their email client will quite happily validate signatures from dozens and hundreds of sources - and how will the user, who has no skill or knowledge in this area, know whether or not the right public key is being used for signature validation? To get to the point where the user doesn't have to make this decision, the number of public keys installed has to be very low, perhaps one, that is, the bank's very own certification authority certificate. What if the user's machine is compromised and another certificate installed? After all, there are thousands, hundreds of thousands of Windows machines in zombie botnets, how do we know the bank's customers are not among them? Hmm, I guess we need multiple layers of security on those machines. All to protect the root key store. Hmm, starting to look an enterprise desktop: Controlled by central IT, not by the user. I'm being fast, superficial, and a little glib in this, but please do think through this from end to end, and be as ruthless as you can in your thinking. PKI works. But only in controlled enterprise environments. In those environments, it works reasonably well. At ongoing expense, sometimes high. Outside those environments, there are simply too many places to inject sufficient doubt so as to invalidate any quantifiable risk assumptions. Which is why email as a consumer service delivery channel is pretty much dead. No control over the consumer endpoint means no assurance that anything there is what it seems. If you cannot control that endpoint, you cannot ask the user at that endpoint to trust you, because you cannot trust that what you sent there is actually what the user sees, nor can you trust that what the user sees is what you sent.