Maybe I'm too demanding, but it seems like all the main web portal/social network providers have the tools at hand to make email secure against the state actor threat: Protocol standards that enable use of open clients, and a social graph and real-time communication tools that would enable a web-of-trust and key signing to prevent MITM. Their ad revenue per user is small and easily replaced by a subscription fee for using their web-of-trust and storage infrastructure.