A hard problem with email is that there is a boundary inside the address itself. How can anyone know this is [email protected]? Maybe an outside authority can verify it's really @example.com but if I thought this was Steve and it's actually Tammy then I'm unhappy anyway.

For your purpose you probably don't think you care. You don't know whether [email protected] or [email protected] or [email protected] is the right email address to be telling you that your complaint is being confidentially processed anyway. But what about [email protected] ? Does it matter if this is really from Steve or the mail actually came from [email protected] ?

Because the web doesn't have this authority boundary the Web PKI can actually assure you of a meaningful fact to a worthwhile degree. This is really https://example.com/. Is example.com really your local plumber Steve? Are they legally authorised to repair your gas appliance? Are they crooks? We can't answer those things. But we can tell you this is definitely example.com