My argument is this: "This is also a PGP application that most people can benefit from immediately (compared to using Hotmail), and one that can be used by even the most targeted users if their environment is set up correctly once the extension is out."

Scramble performed encryption on the server, then my argument is false. But the design of Scramble's protocol is such that the security of the application depends only on securing the client code, which I argue can be done, for those who set up their environment correctly.

That's the point. If you have to "setup the environment correctly" you should implement a native client. GPG is secure because it transfers data...not code. That's actually the webs biggest problem...you can't trust code given to you by some stranger. If you transfer data you can verify that it hasn't been modified in transit. Its really impossible to verify that code given to you performs the way that you think it will.