What is hard about authentication? This was trivial along time ago with mutt and it was still trivial in recent years with thunderbird+enigmail. If your complain is that your favorite email client doesn&#x27;t support pubkey authentication, complain to the vendor.<p>The only thing that should even be relevant re: usability is the need to occasionally enter a password. This is even minimized with gpg-agent (or similar), which we can assume is something that would be setup by IT anyway along with everything else related to email.<p>&gt; C suite<p>Then educate them about the need. Even better, educate the <i>lawyers</i> about why authorizing large purchases (i.e. the type of scam currently being discussed) without proper authentication is an unacceptable risk.<p>&gt; it can&#x27;t help to prevent things like this<p>While you cannot fix a stupid CxO, the problem of deciding if a particular email claiming to to be from that CxO authorizing a purchase order is actually from that CxO is easy.<p>Remember, we only need to solve the internal case, where it is easy to setup PKI. I believe there are even several solutions already available[1] for directory services and key management. Run some sort of local directory service and a local CA and a decent email client should make authentically <i>completely transparent</i> for internal emails.