I'm waiting for Let's Encrypt to start offering S/MIME certificates.

Can you get a free S/MIME certificate? Even if you could, S/MIME leaves you dependent on CA infrastructure that's often state-controlled.

StartSSL [1] and COMODO [2] still offer them (of course, there's still the CA compromise issue you mentioned). Keep in mind, however, that a hierarchical, centralized trust model can still be useful (e.g. in medium-to-large organizations, where having an internal CA and delegating identity verification to a few knowledgeable employees is more practical than having everyone build a web of trust).

[1] https://www.startssl.com/

[2] https://www.comodo.com/home/email-security/free-email-certif...

> Keep in mind, however, that a hierarchical, centralized trust model can still be useful (e.g. in medium-to-large organizations, where having an internal CA and delegating identity verification to a few knowledgeable employees is more practical than having everyone build a web of trust).

Sure, but it's easy to build that kind of model on top of OpenPGP (just have an organizational signing key and tell everyone to trust that), whereas it's almost impossible to build a CA-independent model on top of SSL.

Is S/MIME really that widely used? It seems to be sort of widely deployed, but not necessarily understood or required by users in secure environments.

yes. And it's already supported in many clients without plugins, many companies just sign their mails. You probably don't even notice that if you don't know where to look. It's very unobtrusive compared to gpg.

It's widely used in US government/military. DISA runs key escrow for users' encryption keys that are carried around on smartcards.