[deets]

But that just delegates the problem to the gateway. My personal experience with these guys let's me assume the worst. E.g. not being able and willing to only send me confidential information with signed mail and similar things.

But somebody stores the CC-data, and I wonder why that can't be an encrypted storage only the CC-card-companies can decrypt. Of course this would need some protocol, but can it be so hard (especially when that much is at stake?)