> Suppose myself and the recipient are using x509 certs with outlook and our laptops have encrypted disks with bitlocker or equivalent - my impression is that it mostly covers the basis, is that unjustified?

The risk is that someone steals your laptop while you're signed in and then your disk encryption doesn't do squat. There are ways to deal with this, but very few people are actually doing them.

> Correct me if I misunderstood you, but I don't think emails should be ephemeral. I am have currently several emails from my landlord, the police, etc. that I have to keep for years as evidence in case of a future dispute. While I cannot prove that they are not fake, it's the same for physical letters, yet both are admissible in court as evidence. If I tried to get more reliable proof out of either of them, they might send me a hand-signed letter by post but they'd never figure out PGP.

You did not misunderstand me, but emails absolutely should be considered ephemeral. Google can kill your gmail accounts. Providers come and go. Email chain of custody is difficult and in most cases are easily faked.

Email is an absolutely shit system to use for any kind of identity work. And yet we do, at our own peril. Billions have been lost to email fraud.