Question: I understand that using encryption for email isn't particularly mainstream (a fraction of a percentage of users, at a guess). Is that the only reason that banks and other sensitive companies do not offer some kind of encryption for email notifications?

For example, my bank sends me an email every month:

> 
> **Subject: Your monthly statement is ready**
> 
> 
> Dear Alex,
> 
> 
> Your monthly statement is ready. Please sign in to the bank's website to download it.
> 
> 
> For security *(i.e. to prove this really came from us)*, your postcode is S12 TYX.
> 
> 
> 

While admittedly it's not a huge deal, I'd rather Google - or any mail server - didn't ever receive my postcode in plaintext. This also applies to, for example, receipts from PayPal.

Technically, I would think it fairly trivial for the bank to encrypt this notification using my public key. Is there anything I've overlooked in coming to that conclusion?

Answer: 
Key management is the primary challenge and barrier for peer-to-peer like implementation of encryption (be it email or otherwise). There are companies (like Zixcorp) that simplify data protection for larger organizations. Zixcorp is more commonly used in healthcare than banking. 

Other vendors such as Messagelabs, Websense, and other email security gateway vendors offer similar functionality to Zix where the user receives notification of a message and clicks a link to retrieve the message. This eliminates key management by forcing the user to retrieve the message through a secured channel - still subject to attack and forgery, but such a method is still in use).

Fundamentally, organizations that need to send sensitive information have several options based on their philosophy on customer communication. Forcing users to connect to their servers to retrieve notifications simplifies the communication stream by reducing the "hops" involved as well as minimizing liability by centralizing data storage. For example, if a bank uses Zix, GPG keys, or some other method via a 3rd party to send out communication, there's overhead costs tied to risk of the 3rd party. In the case of GPG keys, what if the bank screws up and sends your info to someone else using the recipients GPG keys? Such an event is easily possible - I still receive payment and account notifications from a big auto financing company after I sold my car to someone else. 

By centralizing communication, it's much easier for a bank to protect the data and reduce liability.
I think it's the lack of widespread usage. I can't think of any technical reason that your bank or any other party couldn't send automated, encrypted emails to you, simply instead I think it's that so few people use any form of encrypted email (and therefore most of the public don't have public keys) that from their point of view it's not worth considering.

Next question is obviously 'How can we provide a secure email setup for the masses, without having to teach them the (apparently too complicated) basics of GPG?'