The real goal here is not to provide state-level security; it is to increase the cost of massive surveillance by deploying the easy parts of PGP everywhere. The people who are highly dependent on security will run through the whole procedure anyway, they won't just rely on whiteout. "Johnny", on the other end of the spectrum, will see the privacy of his communication greatly improved againts passive attacks.

Much like HTTPS Everywhere, it is not enough to guarantee that your messages will be secure against a sufficiently-funded and determined attacker. It puts some power back to the people to enjoy better privacy of communication.

The answer is to increase security by having widely adopted imperfect security rather than supposedly perfect but also imperfect[0] security with marginal adoption.

Having a secure initial message exchange is difficult and will always be difficult. Traditional GPG UIs are so obsessed with trying to solve that problem that they ignore the 99% case, in which something like trust-on-first-use is perfectly fine. The fact is, on average, users will be much safer with a TOFU scheme without any key servers or web of trust at all, as long as that scheme is sufficiently unobtrusive so that it actually manages to get adopted.

The sad truth is that I actually use a mail client with GPG support, but I basically never exchange encrypted email for two reasons: It's not automatic, and the vast majority of users don't have GPG support installed anyway - and I'm not going to push others towards using encrypted email as long as it's harder than "install this plugin and you're done". I have other causes to spend mental energy on.

[0] See other threads about problems with fake keys in the web of trust.

Yes, that is probably the most important part of making a crypto solution actually work in practice. You can't solve all of the problems at once. Trying to solve everything has been shown to have a predictable outcome: nobody uses it and we're stuck in plaintext.

By deploying a partial solution that doesn't attempt to fix all of the problems, we can at least defend against some attacks. More importantly, a partial solution is educational. It introduces the idea of managing keys and wrapping your communications in crypto, which is a new concept to a lot of people. You might consider it "training wheels" for crypto.

Later on - when more people are used to these ideas - it will be a lot easier to upgrade to other methods that defend against the rest of the attack classes. Also, there is a bonus benefit: it is probably a lot easier to deploy a proper PGP/GPG web of trust when you have an existing infrastructure of keys that could be used as another layer of verification.

I think the idea is to create an abstraction layer and make it easy for the whole pgp on "end-user".

Btw, very interesting idea on solving the greater problem around UX and PGP.