Facebook to allow OpenPGP public keys in profiles, can be used for encrypting notification emails
Securing Email Communications from Facebook — It's very important to us that the people who use Facebook feel safe and can trust that their connection to Facebook is secure …
Context & Ripple Effects
In mid-2015, Facebook began letting users attach OpenPGP public keys to their profiles so the platform's notification emails could be encrypted — an early, narrow slice of a broader security push that later included desktop security-key support in 2017 and mobile expansion announced in late 2020.
The move matters because it set the template for how this company handles encryption: opt-in, user-managed, and never the default. A year later, the same pattern showed up when Facebook started testing opt-in end-to-end encryption in Messenger, which reporting attributed to browser key-storage limits and reluctance to force big UX changes.
First-order effects
- Users who add a public key get notification emails only they can decrypt, closing off one of the easiest interception points for account activity — password resets, logins, messages.
- Facebook absorbs the operational burden of a PGP workflow it does not control: users generate and manage their own keys, so failed decryption is the user's problem, not support's.
Second-order effects
- The opt-in model carried directly into Messenger, where the company tested end-to-end encryption as a mode rather than a default — competitors building messaging products faced the same choice between usable-by-default and secure-by-default.
- Security-key support expanding from desktop to iOS and Android shows the same sequencing: hardened options land on one surface first, then propagate once friction drops.
Third-order effects
- If the pattern holds, consumer platforms treat strong cryptography as a feature tier rather than infrastructure — encryption arrives last where UX cost is highest, leaving the majority of traffic on unencrypted defaults.
- That structure invites regulatory attention: when a platform offers encryption everywhere except the channels where most users actually communicate, the gap between capability offered and capability used becomes a policy question.
The trend: Consumer platforms are adopting encryption incrementally as opt-in, user-managed features — PGP email here, opt-in Messenger modes next — rather than shipping secure-by-default communications.