PGP exists, it is just no one uses it

PGP doesn't help you with phone and video calls.

not really the point. a PGP-style tech could easily exist for phone or video tomorrow, if it doesn't already. but PGP-style tech for email (called "PGP") has existed for 32 years and basically no one uses it. whether or not the tech exists doesn't matter nearly as much as whether or not people actually use it.

I'm unclear as to what your point is, then...

you said: "This sort of technology literally makes it impossible to trust anything electronic."

we said: "No, because there is also technology that makes it possible to trust anything electronic with very nearly 100% reliability. But no one uses it"

I think your first statement is both technically wrong and generally wrong. Electronic trust is a solved problem...it's just that right now, it's really not as big a deal as some people are worried about it being, so we haven't generally implemented the solution. We could make electronic cars for long time before other things made them commercially viable.

You can short circuit all that shit by merely compromising the device.

trusted execution is also a thing, just largely unused/underutilized. in my opinion hardware/software platforms can be designed such that the only real exploit would be for someone to insert an attack vector into the hardware (IC) itself, which is nation-state level work. again, possible but not used in practice because of the perceived risk-reward tradeoff at the moment.

Yea until the next Vault7 leaks and the "state level work" is accessible to all.

Ahh, I see.

I disagree that electronic trust is a solved problem. It is mathematically solved, yes, but the reason that it isn't widely used is because it's still intrusive and painful to do. A solution that isn't acceptable to the masses isn't an effective solution.

If it could be done in a way that is invisible (like HTTPS, for instance), then it would be ubiquitous. That's the part of the problem space that still needs resolution.

It's called signing.

I send you a bunch of bytes signed with my private key (which somehow you have to verify in a trusted way) and you can be sure that I am the person who signed those bytes (unless I was compromised).

Thanks, off to work on a new startup!

It doesn't have to be PGP specifically to satisfy the goal of strong keypair-based security finally having traction — does it?

USB etc hardware keys can be used protect accounts like Gmail, Coinbase, web hosting services, many more now.

Fun fact: it's possible to receive Facebook user notification emails encrypted against your public PGP key.