[aroch]

PGP is not supposed to be TOFU, friction to adding/trusting keys is part of the point of PGP -- verification of trust.

If clicking a prominently placed button to lookup a key is not intuitive, then how do these users manage the just as unintuitive process of finding, verifying, and installing an application on their device?

Keys are searchable over HTTP/HTTPS, and the HTTP derived (insecure) hkp and TLS-secured hkps protocols. The whole point of PGP is that you don't trust the source of the key without verification, so the protocol over which you receive the key doesn't matter.

There exist a plethora of implementations that hide the trust-building exercise from users, and they're all for instant messaging. You can shoe horn that into email, but why? PGP is based on the web-of-trust principle of verification; if you just want the attestation that UserX probably owns KeyX, use a service that's tied to your phone number or email that doesn't use PGP -- i.e. textsure, telegram, whatsapp, etc.

[oceanofsolaris]

At least the GPG authors seem to be of the opinion that in order to make their programm usable for a larger amount of users, TOFU would be a good idea [1]. I don't see why hiding the trust-building from users is necessarily such a bad thing if it leads to a lot more people using encryption. If you are an expert user, verifying the keys is not impossible for you, even if GPG uses TOFU.

In the end, the current PGP workflow is simply unusable for many people [2]. It might be a good idea to introduce a new and improved encrypted email protocol, but since PGP/GPG are already here and had a lot of developement, why not make them usable for more people? What percentage of your emails are currently sent encrypted? I have currently two people whom I can send encrypted email; 99% of my email is currently not encrypted. I would really love to increase this.

[1] https://www.gnupg.org/blog/20150911-gnupg-this-summer.html

[2] Edward Snowden had a hard time convincing Glenn Greenwald to set up GPG. Even though he made a 12 minute video that detailed all the (horribly unintuitive for a non-expert) steps. So even with a strong incentive (possible whistleblower contact), the difficult setup procedure was enough to scare Greenwald away.