Creating a GPG alternative is hard. That's pretty much the only reason why it's still around. That, and the ubiquity of e-mail. Sending encrypted/signed e-mail

Creating a GPG alternative is hard. That's pretty much the only reason why it's still around. That, and the ubiquity of e-mail. Sending encrypted/signed e-mail with GPG isn't hard when you're using things like Enigmail. Maybe the GUI could be a little friendlier, I don't know, but the encryption part isn't hard. Key management, now that's hard. Not just in terms of usage, but in terms of explaining it to new users. On the one hand, both parties need to somehow exchange keys before they can communicate in a secure fashion. Doing this is hard, and if done wrong can leave you vulnerable to attack. That's why we verify key fingerprints. If there's an easy way to make this painless, I don't know it. Central authorities like what we've got with TLS/HTTPS are obviously a steaming pile of shite. Decentralized (like GPG) are difficult for users. What else is there? I don't know.