ProtonMail introduces full PGP support and address verification, which uses the encrypted contact feature to protect users against man-in-the-middle attacks
In the latest update of ProtonMail, users can now take advantage of the full (Pretty Good Privacy) PGP support and address verification tools, for added security.
Context & Ripple Effects
ProtonMail has been assembling the pieces for this for over a year: it debuted an encrypted contacts manager with digital signatures in late 2017 to verify data integrity, then extended that manager to its iOS and Android apps in March 2018. Full PGP support plus address verification is the payoff — the contact records now double as a key-verification layer against man-in-the-middle attacks.
The move also fits ProtonMail's pattern of hardening against interference rather than just encrypting at rest, following its earlier Tor support aimed at thwarting meddling governments. For a service courting journalists protecting sources, verifiable addresses close the gap between encrypted transport and authenticated identity.
First-order effects
- ProtonMail users can now exchange PGP-encrypted mail with external clients and verify correspondent addresses through signed contact entries, directly blunting man-in-the-middle key-substitution attacks.
Second-order effects
- Competing webmail providers face rising user expectations that end-to-end encryption interoperate with the open PGP ecosystem rather than stay siloed inside one provider's walled garden.
Third-order effects
- If mainstream encrypted email converges on open standards like PGP with built-in key verification, provider lock-in weakens and trust shifts from brand promises to independently checkable cryptographic proofs.
The trend: Encrypted consumer services are shifting from proprietary security claims toward open, verifiable cryptography that users can audit themselves.