Web of Trust itself is the problem

[dan at geer.org]

David Shaw writes, in part:
-+-------------------------
 | It's not that they gave it a bit of thought and decided
 | against it for  whatever reason - they never gave it even a
 | moment of thought.  The  only crypto they use is the crypto
 | that is invisible to them (usually  https, which is pretty
 | invisible).


I used to work at Verdasys.  One of the strong
selling points with its customers is as you say,
for crypto to be in place but with no user the wiser
nor need that they be.  A piece of marketing material:

http://www.verdasys.com/images/uploads/Encryption_DataSheet.pdf

There are quite a few installations of the above at
the >100,000 seats level (enterprise deployment).

--dan