S/MIME could work well but the CA Cert situation doesn't allow it for normal people.