I believe the mainstream Web services hold the key (no pun intended) to UX for web-of-trust key exchange. Their users have access to real time communication which would make subverting key exchange and key signing hard, and building a Web of trust convenient, including key replacement, etc. The secure specialty services don't have that capability, and so they remain privacy-for-wonks.

I'm certainly willing to consider that I could be wrong about that. But with trust in short supply, someone should be tempted to build products that say "Trust no central authority, trust this math and the open code that implements it."