<i>The rule is, "data in motion should be secured with TLS, data at rest should be secured with PGP".</i><p>Isn't this more of a heartfelt wish than a rule, though? It's restrictive enough to be impractical, I would guess even for security researchers. Do you use SSH to access remote machines?