I've seen that pattern too, and perhaps I'm a little guilty of it.

But if you say:

> we want to encrypt this field with your public key before sending it to you

and they respond:

> yeah, we can handle that

and then contracts with deadlines and penalties are signed... Wouldn't you expect there to be somebody on the other end that is willing/capable to generate a GPG keypair?

At what point is it worth holding their hand through the technical bits, and at which point would it be better to replace them?