That's a personnel problem, not a technical problem.

Ignoring user behaviour makes any kind of security solution fundamentally flawed. Good security takes into account what people do and how they behave when they reach obstacles.

Building your security solution in an ivory tower and then pushing on people will result in an utter failure - see PGP or password post-it notes on monitors.

I agree that working with rather than against people's inclinations to reinforce security protocols is the best method. I'm a bit concerned that it's commonplace that people will route around those protocols in an environment where presumably the staff is all highly trained and disciplined.

This is intended to be use by the french administration (eg. the DMV), not intelligence agencies or the military. Sensitive in this context means nonpublic, not classified.

(Administration in French would be the government in English - as in government shutdown, while government means administration in English - as in the Trump administration)

This is a great point. I tried to push use of SSH keys only to have see people put them in Dropbox or send the private key by email.

A functional organisation has to take into account the fact that its personnel is made of humans, though.

It's still a problem.