GPG, with its old technology, bad design, and small userbase, is dead; it's time for a more usable encryption system
Blog >>- GPG And Me — I receive a fair amount of email from strangers. My email address is public, which doesn't seem to be a popular choice these days …
Context & Ripple Effects
When Moxie Marlinspike — creator of a rival encrypted-messaging stack — published "GPG and Me," he attacked PGP not on cryptography but on usability: public-key ceremonies too awkward for ordinary correspondents, and a userbase so small it offered no network effect. The related coverage shows his critique aging well rather than fading.
Within four years of the post, researchers disclosed critical PGP and S/MIME flaws that could reveal plaintext and told people to strip those plugins from their mail clients outright, while an OpenPGP certificate-spamming campaign broke a core component exploiting a weakness known for a decade — and even correctly applied PGP still leaks message metadata. The ecosystem's institutional bets fared little better: Google handed its long-running Gmail end-to-end project to open-source maintainers without ever shipping it as a product, and Facebook's profile-key experiment stayed a niche notification-email feature.
First-order effects
- Users who followed Marlinspike's advice dropped GPG for everyday email, shrinking further an already tiny userbase whose size he cited as the reason the tool could never be usable.
Second-order effects
- Big-platform attempts to rescue the model — Facebook accepting OpenPGP keys in profiles, Google's Gmail end-to-end effort — produced integrations that either stalled or served narrow uses, confirming that bolting keys onto existing email beats no one's workflow.
Third-order effects
- If the pattern holds, secure email abandons the standalone-tool model entirely: encryption either ships as invisible default behavior inside messaging platforms, or the use case migrates to channels like Signal-style apps where key handling is automated — with the passkeys debate over sync-versus-lock-in showing the same usability trade-off now playing out for authentication.
The trend: Email encryption is migrating from opt-in PGP tooling toward automatic, platform-integrated schemes, with each successive PGP flaw accelerating the exodus.