emails have been interoperable since the beginning of time!
It's only impossible because the business models formed after the explosion of the internet required that they own the platform for profit. And doing so requires that other platforms not intrude. Hence, the failure of interoperability.
The IMAP protocol is a known dumpster fire but getting jmap implemented over every email client and server is basically impossible. Gmail avoids this by just implementing their own proprietary protocol which only works with gmail and the web ui/apps.
Have you considered that it’s the password reset center because it’s the only thing that works well enough?
Anything completely proprietary is a joke for security from a business continuity perspective. It’s the same reason serious companies don’t depend on “sign in with Facebook” as their only login method.
Well that’s a clause doing a lot of work. I guess email could have been the permanent contact repository a la Facebook if it had been easier for people to own their own addresses
Email encryption is different because HTTPS certifies that you are connected to the owner of that domain name. How do I certify to you that the email you just received came from me and not someone pretending to be me?
The only bullet proof secure way is if I visit you in person and hand you a copy of my public key and then you use that key to verify my emails. We have had tools to do this with email for over a decade but they are so inconvenient that no one uses it outside of a few privacy nuts.
I use PGP quite often. And I know how hard it is and how much it lacks.
But I'm no 'privacy nut'.
A legitimate easy and underused option is how kraken employs it. I've uploaded my public key. They now send all transactional, security and other mail signed and encrypted. This is a solid solution to phishing.
The only part 'missing' is how I get my pub key on my kraken account. For me it was an export+copy+paste. But it should probably as easy as an OAUTH alike flow between kraken and my mailprovider. 'Kraken wants to import your public key to sign and encrypt it's emails to you'. An UI thing.
There isn't anything quite like the Browser - Webserver simple connection to encrypt. I would like my connection encrypted to my mailserver using SMTP/POP3/IMAP/HTTP + TLS, which it can be. I would like my email server to talk to your email server using TLS which it can do, but isn't guaranteed, there are several approaches to it (STARTTLS and others). I would like incoming mail to be spam-filtered which means a service that can read the content. My company would like incoming email to be malware and phishing filtered, which means accessing the content. My company would like outgoing email to be signatured and branded, same again. My company requires email to be archived for legal reasons and cloned off-site for DR reasons. The design of SMTP involves store-and-forward, failover and fallback options, multiple MX records, so there's not a trivial path email always takes from sender to recipient. Attackers will try to intercept SSL connections and force fallback to plain text SMTP and people would rather email arrives than doesn't arrive. Tons of companies are using ancient not-updated network equipment which proxies and edits SMTP traffic as it goes through. Coworkers would like Webmail which almost necessarily requires the server having access to unencrypted email to show it to you in a browser.
Trying to put some kind of "secure" on top of that pile of entrenched systems is much harder than saying "the biggest players don't want it", what would it be, which layers would it go in, which sides would manage it, how would it interact, who would standardise on it, how much bother is it for users and for people who forgot their password? The main approach is to public/private key outside email and send encrypted blobs to each other, which is full of key management problems, or a service which intercepts email and pulls the text out and sends on a HTTPS link and a blank "someone sent you an encrypted message. Sign up and login to view it" which sucks, but is a lot more practical and does actually work.
"How all messages are sent" and "who signed the message" are mostly separate issues. See for example https://en.wikipedia.org/wiki/Off-the-Record_Messaging which works on pretty much any messaging app/network.