OpenPGP is impossible for most email users to get working correctly.
Remember that most people don't even know the difference between CC and BCC.
Here's an example of de-anonymising anonymous messages, supossedly from clueful users: https://ritter.vg/blog-deanonymizing_amm.html
Difficult perhaps, certainly not impossible, and quite feasible if someone helps you. But I am not suggesting OpenPGP as an alternative for chat-apps for everyone; only for those who understand how to use the technology properly.
I mention OpenPGP and XMPP OTR because they are examples of open standards that do fulfil the principles outlined above. That is, to illustrate that it is certainly not impossible or infeasible to create such a technology. What is missing is a technology that does that, and allows anyone (regardless of technological prowess) to use them safely. It is a tough problem though.
In kmail, to use GPG keys, I need to go to Settings -> Configure -> Identity -> Modify -> Cryptography, change my signing and encryption keys (and it supports PGP or MIME) and then, since I don't already have keys, need to open Kleopatra, the KDE GPG client.
Kleopatra uses keys.gpupg.net as its default keyserver, and you can do file -> new certificate to make one. Its a wizard, so you go step by step, setting up a password for the cert along the way. You also make a revoke cert you save somewhere.
Once you made the key, you need to export it to the server. And you probably want to make a signing and encryption key, since if you got this far you are already a super techy nerd and that is what makes my point right there.
If you want normal people to be able to use gpg in kmail, there needs to be a wizard just like the "add account wizard" called "Setup GPG" that searches for keys that match your email address first in case you already have them and if there are none generates you new ones and just asks you for the password. It handles the propagation and importing of keys itself because thats not something a user should be dealing with unless they need to.
And even that is unlikely to happen - you want the GPG setup to really be a part of the first-start of Kmail process. Like the first time you open the program and get the "add account" button you should also get "setup security".
But even if you can get people making keys, the UX sucks because it makes them enter a password every time you send an email. You should be able to do what kwallet recently did, and bind the unlock key to your GPG keys to your user session so that when you enter the desktop via SDDM it unlocks your GPG keys just like it unlocks your wallet. Then people can use secure email whenever they want without any bullshit.
There are even more UX nightmares - getting your keys across different computers, easily revoking them if they get compromised, even knowing what that means.
By comparison OTR in Telepathy is almost usable. In KTP you just hit the "use OTR" button and if your chat partner does the same it automagically generates and shares the keys, no user interaction required. The only downside is that you don't get local logging of your OTR conversations - that should definitely be an option, maybe even encrypt them with your kwallet keys! Eh, eh?
But these kind of UX nightmares keep secure communications from being a thing. Mumble is literally the best security solution I have, because I can get a letsencrypt cert, run my own server, put on a password, and anyone chatting on it has perfect security in voice and text - the whole thing is encrypted, I can do my own trust network based off my x509 cert, and it even supports pinned users so nobody can impersonate anyone else.
But I say that its the best because for anyone I invite, they literally just need to enter the password I give them to my server. Sure, its problematic to give them the password if you don't have a secure communication link beforehand, but I guess thats what OTR is for! Oh drat...
The perfect PGP secure email client would be cross platform and provide its own email server. The client has included trusted keys to communicate with upstream, but when you first start it you make your account and that generates you a signing and encryption key based off your password, backs it up on their server (remember, its password protected, they cannot access it despite backing it up) and then whenever you sign in on other device your keys are downloaded and just work.
This basically turns PGP into username / password, but the only alternative is to use wifi to send your keys between devices when you first start your client of choice - IE, you start it for the first time, it says "do you already have an account? You say yes and it simply asks which PC on the lan has your keys, it communicates with it, you confirm on the other computer to send the keys, and it synchronizes your keys cross-device peer to peer.
And I worry even that is too complicated for my grandmother to be willing to put up with to stop the NSA from reading her emails.
> This basically turns PGP into username / password, but the only alternative is to use wifi to send your keys between devices when you first start your client of choice - IE, you start it for the first time, it says "do you already have an account? You say yes and it simply asks which PC on the lan has your keys, it communicates with it, you confirm on the other computer to send the keys, and it synchronizes your keys cross-device peer to peer.
Or you could carry your keys around with you on a physical smart device that communicates over usb or nfc. This ux already seems to work well in corporate environments, it's just a matter of convincing consumers it's worthwhile and vendors to bake support into their products.
However Mumble is not a valid comparison, because Mumble is not End-to-End encrypted. The security of Mumble amounts to an encrypted connection to the server, protected by a password; from this POV Mumble is no more secure than Facebook or Hacker News.
"You're browsing without Javascript! If you have no idea what that means, you should ask your technical friend about it. Otherwise - kudos."
No, kudos to you. I could count on one hand the number of times I have been congratulated by one of these capability detection messages for browsing without Javascript.