Orr you could buy a domain, and use a catch all email rule and then use an unique rmail address per site. Like mybank@mydomain, yourepamsite@mydomain ect.. I've never had any security problems.
What tracking will this defeat that couldn't also be thwarted by putting dots and plus modifiers in a Gmail address?