Did you read the article, which talks about the two options that Hushmail offers? The server side (weak) encryption and the client side Java option?

And the fact that even Hushmail said that they could be forced to serve malformed Java applets to targets.