Question: I understand that using encryption for email isn't particularly mainstream (a fraction of a percentage of users, at a guess). Is that the only reason that banks and other sensitive companies do not offer some kind of encryption for email notifications?

For example, my bank sends me an email every month:

> 
> **Subject: Your monthly statement is ready**
> 
> 
> Dear Alex,
> 
> 
> Your monthly statement is ready. Please sign in to the bank's website to download it.
> 
> 
> For security *(i.e. to prove this really came from us)*, your postcode is S12 TYX.
> 
> 
> 

While admittedly it's not a huge deal, I'd rather Google - or any mail server - didn't ever receive my postcode in plaintext. This also applies to, for example, receipts from PayPal.

Technically, I would think it fairly trivial for the bank to encrypt this notification using my public key. Is there anything I've overlooked in coming to that conclusion?

Answer: 
I think it's the lack of widespread usage. I can't think of any technical reason that your bank or any other party couldn't send automated, encrypted emails to you, simply instead I think it's that so few people use any form of encrypted email (and therefore most of the public don't have public keys) that from their point of view it's not worth considering.

Next question is obviously 'How can we provide a secure email setup for the masses, without having to teach them the (apparently too complicated) basics of GPG?'
(I think you are really asking about signing the email, not encrypting it. Signing is the relevant cryptographic primitive, since you want to verify the origin of the email.)

**Overview.** It is far from trivial for the bank to send all of its customers signed email. There are three major challenges:

* **Deployment.** Many users' email clients don't support signature verification, so this would have no value for them.
* **Key management.** How do users get their bank's public key, in a way that isn't subject to spoofing? These issues are not trivial.
* **Usability.** Finally, the most serious issue: signed email is not usable by average users. It is horrifically confusing for end users. Apart from the fact that any security mechanism that isn't usable, won't have much benefit to security -- just think of all the help desk calls the bank is going to get about this. Each help desk call probably costs the bank $20-40, so that'd be a serious cost. Ouch.

**Details.** For more on this topic, I'd like to point you to some scientific papers in the research literature:

* [Views, Reactions and Impact of Digitally-Signed Mail in e-Commerce](http://www.simson.net/ref/2004/fc2005_smime_submitted.pdf). Simson L. Garfinkel, Jeffrey I. Schiller, Erik Nordlander, David Margrave, and
Robert C. Miller. FC 2005.
* [How to Make Secure Email Easier To Use](http://www.simson.net/ref/2004/chi2005_smime_submitted.pdf). Simson L. Garfinkel, David Margrave, Jeffrey I. Schiller, Erik Nordlander, Robert C. Miller. CHI 2005.
* [Johnny 2: A User Test of Key Continuity Management with
S/MIME and Outlook Express](http://simson.net/clips/academic/2005.SOUPS.johnny2.pdf). Simson L. Garfinkel, Robert C. Miller. SOUPS 2005.

For instance, the last work shows that something like 20-50% of users fail to use signed email securely, and thus could be fooled by various attacks.