That might work; can either of these be configured with separate encrypt and decrypt keys?

Basically, if someone takes control of the hardware or software we're hoping that it would still be very difficult to get at the contents of the emails.