By some definition, accessing gmail over TLS counts as "in-flight encryption" too.
Encrypting when the organization has the keys is only effective when accessing the ciphertext is easier than accessing the key material.
I'd prefer a solution where Google could only store encrypted blobs with no access to my keys and all decryption happens on the client device.
https://cloud.google.com/security/encryption-at-rest/#encryp...