Matt Cockayne says that in roughly twenty years of publishing a PGP key, he received one encrypted email from another person and sent one test message to himself. That is a count of two messages in his own experience—not a measure of encrypted-email use generally. His essay’s more useful point is that a reporting channel can matter even when few people use it: a clear, working route tells a security researcher how to contact the site owner. Cockayne’s essay was published September 18, 2026.
What does “two encrypted emails” mean?
Cockayne’s count consists of one encrypted email from someone else and one test message he sent to himself, according to his account. It is a personal anecdote, not a representative statistic about people or organizations. The title’s low number might seem to answer the question “Why publish a PGP key if nobody uses it?” Cockayne’s answer is that the option may still help a researcher who needs to report a vulnerability—and that making the route discoverable is part of maintaining it.
As an Amazon Associate I earn from qualifying purchases.
Why a visible reporting route can matter
Cockayne imagines a researcher who has found a possible vulnerability but is unsure whether contacting the owner is worthwhile. In his view, a visible contact route, clear instructions, and signs that a real person will receive the report can make the next step easier. He uses an airport-security analogy to describe the signaling role of visible security practices; it is an analogy, not evidence that an encrypted email channel prevents attacks or reliably increases reports.
The narrower case for making contact details easy to find is reflected in RFC 9116, an informational IETF RFC published in April 2022. It describes security.txt as a machine-parsable way for organizations to communicate vulnerability-disclosure practices and contact methods. The RFC says the file complements rather than replaces other public resources about disclosure.
#1 Best Overall
- [Secure & Application]: Smart cards are equipped with high level security chips SLE4442(256 Bytes of protection memory). The SLE4442 Chip is perfect for many uses, Like access control or hotel key card.
- [Great Compatibility] - (Does NOT Work with INKJET Printer) Get a Great Graphic Quality Print with All of The Most Popular Card Printers - Evolis, Zebra, Badgy, Fargo, Magicard and DataCard.
- [Card Arrive Safe & Sealed] - The white PVC Cards Arrive Sealed in Shrink Wrap - No Loose Cards Banging Around in Your Shipment - We Realize that Only Clean and Undamaged Cards will Work with Your Expensive Printer and Protect it for Years of Use.
- [Writeable And Readable] - Using the card reader, you can read and wrie the information of the blank chip cards.
- [Standard Credit Card Size]- 3 3/8" x 2 1/8" (85mm*54mm) Standard Credit Card Size (CR80 30 Mil) - Printable PVC on double Side - SLE4442 chip on the front - No Adhesive - No Pre-Punched Slots
What belongs in security.txt?
For websites, RFC 9116 specifies /.well-known/security.txt as the location; it also permits a legacy root path for compatibility. The file must include Contact and Expires fields. An Encryption field can point to a retrievable key for encrypted communication; it points to the key rather than embedding it.
- Contact: Where a researcher can report a vulnerability.
- Expires: When the file’s information should be considered expired.
- Encryption: A URI where a key can be retrieved for encrypted communication. When the contact is an email address, RFC 9116 recommends encryption.
A key link is not proof of authenticity. RFC 9116 leaves researchers responsible for deciding whether the named key is one they trust. A disclosure policy should also explain the reporting process; a security.txt file is a contact aid, not a complete workflow.
What Cockayne found in his own setup
Cockayne says his security.txt already listed contact, expiry, language, canonical URL, and policy information, but omitted an Encryption field even though he had published a PGP key elsewhere. He says he added the missing field after looking at the page as a researcher might.
He also reports that his key was discoverable through WKD’s advanced method, while the apex path used by the direct method returned a 404. On his account, a client limited to direct lookup could therefore fail to find the key. These are Cockayne’s site-specific observations; they are not an independently verified configuration report.
Rank #2
- Please kindly noted: AT24C64 is IS07816 Standard Contact chip IC Card with 2-wire Serial EEPROM Card . It's blank ,NO Data! Please make sure your device and Card Tool support READ WRITE it. You need to have professional knowledge and know how to read and write it before you order !!!
- The AT24C64 provides 65,536 bits of serial electrically erasable and programmable read only memory (EEPROM) organized as 8192 words of 8 bits each.
- Contact chip blank card (#AT24C64 Chip) ,64K SERIAL EEPROM Internally organized. It made by PVC Material. Standard Size: 85.6 x 54 x 0.84MM
- Function: It supports ISO7816 standard contact chip card reader writer read write . Like ACR38U-I1 , ACR39U, N99 Card Reader Writer etc
- Package Included : 10pcs AT24C64 chip cards. It can't print by INKJET Printers
His essay also raises concerns about particular Go OpenPGP software components: he describes one package as frozen and carrying an advisory, and a fork as maintained by one company for its own product. Those are his reported implementation concerns, not a finding that OpenPGP as a standard is unsafe. The IETF’s RFC 9580 specifies OpenPGP; the standard alone does not establish the maintenance status of the libraries Cockayne discusses.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Encrypted email is one possible reporting route
Cockayne favors alternatives including a properly secured web form over TLS and peer-encrypted messaging. He also mentions a direct message to his Discord bot as a personal idea for his own infrastructure. The essay does not compare these options experimentally, so none should be treated as universally safer or more effective.
A useful reporting channel depends on more than encryption. A researcher needs to find it and use it without unnecessary friction; the report must reach the intended recipient; and someone must monitor the route and be able to respond. Each option also has maintenance demands: keys and instructions can become stale, and a form or messaging account can go unattended. The relevant question is not simply whether a channel exists, but whether its instructions, recipient, confidentiality, and monitoring still work.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
