[mmooss]

> Hundreds of emails between co-workers and it was all contemporaneously related to work in progress or cat pictures of your own cats, didn't contain PII or proprietary information of your employer or unaware third parties?

You're merely defining away the problem. You have no idea what was in those emails.

[m3047]

Whatever was in those emails wasn't important enough for them to unencrypt them in a durable fashion, or put the keys in a safe with the gold bars.

We call this the "scream test" in BOFH land.

[yardstick]

Who knew I’d need to do this? I’d never needed to do this either my emails in the decades prior.

You’ve also got no idea what was in those emails. Could be some valuable knowledge or logs about some crazy rare bug or scenario, and would be useful to review today.

We just turned on S/MIME by default, to “be secure”, whatever that means. There was no warning in the email client about losing access to the email if you lost your keys.

Citing BOFH is all well and good inside certain circles. In the real world, people don’t like spending time or effort on poorly thought out and implemented solutions.

[m3047]

The keys aren't in the backups you still have?

IOW: who owns the backups owns the data... until proven otherwise. My default presumption from space is that 1) there are document management policies and 2) document management policies apply.

[mmooss]

It wasn't important enough at the time to the BOFH.