Of course your autosaves will still be sent to gmail in plaintext while writing your original message.

I am offended that people try to sell me AES as if that was a necessary and sufficient requirement for security. In this case, it's certainly not sufficient...

What we really need is the ability to use pubkey systems like OpenPGP without hacking the script context of a page (a la FireGPG--- while good, it was fragile with respect to Gmail changes). I would love to have browsers bake in PGP support and for sites like Gmail and FB to start relying on the browser for encryption services.

It's best done at Google or at your email client. Anything elsewhere (e.g., at a browser) will suffer the same fate as FireGPG. I don't see Google ever doing it for Gmail -- normal people don't care about encrypting their emails, and Google will not want to risk losing the ability to show context-sensitive ads.

Ah yes, AES implemented in javascript and dropped in a page via bookmarklet. What could possibly go wrong?

Perfect. And the password will be shared over Google talk, I bet.