Email is fine. It's simple, it maps very well to peoples' intuitive real-world understanding of "mail" and it works. I've had the same email address for decades. I get some spam, but I don't drown in it. I get
more spam in the real (postal) mail, if you measure by the ratio of spam mail to legitmate mail. And I get real mail that is spam but looks legitimate on first inspection.
It's generally very easy to identify spam email, and delete it. I can almost always do this by the sender and subject line alone, without opening the message. It takes less time to do this than it does to periodically peruse your spam folder for false postives.
Encryption/digital signatures that rely on any kind of PKI architecture won't work, because most people don't understand it or won't trust it or both.
What might work is ssh-like "trust on first contact." You get a signed email from a friend. You get a little notice "you haven't seen this signature before, do you want to trust it." You can turn it off if you don't want to bother with this, and you need to be able to easily revoke the trust if you make a mistake (so even this is getting complicated). The keys need to be generated with no more complexity than "ssh-keygen" (and I work with many people, college-educated, who can't manage even that).
I'm in tech, I do it for a living. I don't sign my email, and I don't verify signatures on the signed email I get. If I don't think it's worth the bother, my mom certainly won't.
It's generally very easy to identify spam email, and delete it. I can almost always do this by the sender and subject line alone, without opening the message. It takes less time to do this than it does to periodically peruse your spam folder for false postives.
Encryption/digital signatures that rely on any kind of PKI architecture won't work, because most people don't understand it or won't trust it or both.
What might work is ssh-like "trust on first contact." You get a signed email from a friend. You get a little notice "you haven't seen this signature before, do you want to trust it." You can turn it off if you don't want to bother with this, and you need to be able to easily revoke the trust if you make a mistake (so even this is getting complicated). The keys need to be generated with no more complexity than "ssh-keygen" (and I work with many people, college-educated, who can't manage even that).
I'm in tech, I do it for a living. I don't sign my email, and I don't verify signatures on the signed email I get. If I don't think it's worth the bother, my mom certainly won't.