Design for security

I sat down with some friends--all of us professional sysadmins--a few years ago to learn GPG / PGP well enough that we could teach our friends and family members, get people using encrypted email, make the Internet a better place, yadda yadda. In 3 hours, we could not do secure email using any combination of FOSS email clients. We gave up, reaching the conclusion that developers working on GPG and email client plugins should seek other career paths.

Now we use Keybase and and it just works. We use our real names, actual photographs of ourselves, proofs anywhere we possibly can, and we only "follow" each other after verifying account ownership in person. (We treat "following" the same way as signing someone's public key, and make sure they understand that before following them.) The UI isn't great, and the .deb is >100 MB, but you know what? Good security is inconvenient, and having to download a 100MB .deb every other day is still a million times better UX than GPG.