I think a lot of people think about encryption technologies in terms of global adoption. HTTPS, encrypted filesystems, and E2E encrypted messaging have all reached a significant percentage of global Internet users.

But in that context, 50k PGP users is arguably "almost no one." If we guesstimate 4 billion Internet users, that's 0.001% of all users.

I think the point is not that PGP is impossible to use, I think the point is that PGP is not appropriate to scale to the global Internet the way other encryption technologies have.

It's not true that something isn't valuable just because it hasn't scaled.

PGP has an outdated and confusing UX, a broken threat model, and is extremely bad in many respects. But it does have users, and for some people and some tasks, it works better than alternatives. (My use cases: exchanging routine work email with other nerds who have it set up, share confidential documents.)

So, while we shouldn't minimize its very major problems, we shouldn't pretend that its user base does not exist and that it's not addressing at least some use cases.

So you mean to say is that PGP is wildly or only popular with criminals?

If criminals don't use your privacy tech, it probably doesn't work.

Conflating "people that practice good OpSec" and "criminals" is disingenuous.

Which would be an excellent endorsement for PGP, provided that the said criminals don't get caught.