Have a look at mailvelope[1]. It enables you to use gpg in your browser. Two larger german e-mail providers (gmx and web.de) even integrated it into their web interface[2].

[1] https://www.mailvelope.com/

[2] https://www.mailvelope.com/en/blog/gmx-and-web-de-launch-pgp

Someone (like gmail) can even do rich text editor for emails and stuff - without compromising security. let's say separate sandbox w/o internet and write access to cookies etc.

load scripts, css, images. show native window (clearly different than anything js can do) with that rich text editor inside. user types message in, system encrypts (and/or signs) the message. regular html page sees the result.

There is a Chrome extension that does something like that: https://github.com/google/end-to-end

Obligatory warning: it's in an alpha state according to the readme, so you shouldn't use it yet for real.

Or you know, just use a email client and use S/MIME which most email clients support.

Yeah, but then it's a pain when you want to check your email from a friend's computer or something.

How rare is that? Basically everyone has a phone today with an email client.

You shouldn't do that anyway because you're giving your password (and your keys if you encrypt!) away with that.

The problems are that some people hate the certification scheme of S/MIME and use GPG which isn't better at all. Then it's user unfriendly to generate the certificates (if you want to be a good email provider, do the job to provide your users with signing of certs) cert and to get them onto all of your devices (I'm looking at you Apple!).

Not terribly rare for me - I probably do it about once a week.

Currently my threat-and-countermeasure model doesn't include obfuscation from the eyes of state actors. I do want to change that, though, so I'll have to break this habit.