[jasonjayr]

Now that Google is shooting to be their own CA, couldn't they mass-generate S/MIME certificates for all their users?

Even if the sender and receiver is Google-hosted, they could still encrypt mail, so it's encrypted at rest if it's copied from a user's gmail account to their local mail via pop/imap? And, since Google would be generating the private key, they could also decrypt it server-side in their secure environment, do whatever scanning for advertising/spam classification, and still deliver the same product?

As other users have pointed out, if you're trying to protect against an adversarial Google, you've already lost by using gmail. If you're going to trust them with message composition software, and transport, just go in whole-hog.

As far as I can tell, Google seems to have their security ducks in a row, and take this stuff seriously. Deployed correctly this could be another "raising the bar" event on email security, and help mitigate against servers still not requiring tls/ssl on port 25.

[irq-1]

Not only should they mass create keys for all accounts, but they should make (other/more) keys available for any purpose. An open system where most email addresses come with a set of keys would enable many types of encryption systems (file sharing, login, messaging, etc...) Users would still have keys managed by Google (or IT, or their webmail host) so they don't have to understand key management, and they'd have someone to call when things break.

[mikecb]

AFAIK the recent key transparency initiative is also the missing link in bringing the end-to-end to Gmail for real.