You are right. It is cumbersome. PGP using free tools is pretty involved using anything but Thunderbird and Enigmail in my experience, and even s/mime using Outlook changes the user experience.

The real problem is that someone else reading your mail is an invisible threat. It’s harmless in terms of direct consequences for most people – unless perhaps you’re sending child porn or something – so they don’t think it’s “necessary”.

I believe that it can be made to be simple, but it’s going to take buy in.

In any case, the evidence of non-use is clear – the two companies I’ve contacted about setting up PKI, Thawte.com and Verisign.com don’t seem very responsive.

SSL certs seem to get much more attention.

However, one company I work with has requested that all comms with them be encrypted. I’ve requested it of others. We’ll see how it goes.

I’m not an email or encryption expert, but I can speak from experience that I am an advanced technology user (power user by any comparison) and I’ve never run into anyone else using digital signatures in email, etc (even in the Enterprise companies I’ve worked at in the past).

Let me be clear….so that I don’t get flamed on this blog as well……I’m not stating that Secure Email is ‘stupid’ or that it doesn’t exist…I’m simply stating a very real fact that very few people use it (outside of government agencies, enterprise companies and Closed Notes/Domino Environments).

The very fact that it took you several posts to describe the ins and outs of your secure email experience is testimony enough that its NOT for the “average business person” yet.

Its sad and unfortunate, but true.