Article author seems to be suggesting that Gmail et al. manage the key signing though, so still the same as https in that regard.