All this talk about email forgery... so why isn&#x27;t all all of this email authenticated with GPG? This type of authentication is a <i>solved problem</i>.<p>Yes, in the <i>general</i> case PKI is a broken and web-of-trust is hard to bootstrap, but protection against scams like this don&#x27;t need to solve the general case. Distributing keys internally isn&#x27;t hard. Even <i>some</i> communication external to the organization should be easily authenticated with pubkey crypto - it&#x27;s not more difficult than the business contracts everybody already uses regularly.<p>Why is everybody trying to solve this with <i>email headers</i> or <i>fallible human judgment</i>?