IIRC (and correct me if I'm wrong, I haven't used PGP extensively), but Facebook wouldn't be able to decrypt a message they encrypt to you. They'd only be able

IIRC (and correct me if I'm wrong, I haven't used PGP extensively), but Facebook wouldn't be able to decrypt a message they encrypt to you. They'd only be able to if they had your private key (since the message is encrypted using their private and your public key). That's the whole thing about PGP, if someone were to get ahold of a private key, they'd only be able to decrypt everything sent to that person, not sent from. So really, the only one at fault for someone else reading the message would be the key owner, who's responsibility it would be to store that safely. And once again, we ask, how is this "theater"? Everything points to it being a net positive security wise. If you want to debate PGP, or the usefulness of encryption, then I'm sure there's plenty of forums for that. But in terms of the actual feature that Facebook just implemented, it's a security gain as before we had nothing, and, by definition, can't be called a security theater.