It's not just Google and Yahoo, it's the other email providers, i.e. Your employer.
It's pretty common for corporations to use their own root certificate so they can snoop your HTTPS, one would have to assume security officers wouldn't be really interested in individual employees encrypting their mail at the MUA and the company losing visibility on outbound messages.
The thing I never got though, is why signing messages never really caught on. You'd think banks and financial service providers would have an interest here. Maybe they don't want to deal with the support headache.
That one constantly perplexes me. The GPG signature, or X.509 even, means nothing in the message. But if you go to the trouble of putting it in there, then I can actually run checks.
Conversely....I can see the argument not to. Uploading 50,000 1-character name mismatch to bank encryption keys would definitely happen.
Employers that care about this will simply ban origination of E2E secure messages from their networks. Plenty of large companies already ban web mail providers entirely, for similar reasons. So this isn't much of a factor in adoption of encrypted mail.
Right but my point is, big corporations are actively opposed to E2E secure messages and that's a barrier to adoption.
Few if any big companies are going to be sending you GPG/PGP encrypted or signed email or be willfully receiving it. Take the Fortune 1000 off the list of potential secure email users and you've got a large portion of the professional class who won't know how to use this technology. I think that's a barrier to adoption.
If you don't trust your send gateway then you are without a doubt hosed anyway, as they can just strip your signature anyway (or, replace it with one linked to a key they generated in your name on the fly). Yes, if your correspondant is super on the ball and notices that you didn't sign/encrypt this specific message, maybe you win. But if I were a bad MITM I'd just put "Sent from my iPhone" at the bottom and there is the plausible explanation.
It's pretty common for corporations to use their own root certificate so they can snoop your HTTPS, one would have to assume security officers wouldn't be really interested in individual employees encrypting their mail at the MUA and the company losing visibility on outbound messages.
The thing I never got though, is why signing messages never really caught on. You'd think banks and financial service providers would have an interest here. Maybe they don't want to deal with the support headache.