If PGP wishes to succeed in the commercial marketplace, there is another
standard that must be considered: FIPS-140. Increasingly I am seeing contracts
which have provisions for secure tranmittals which requires this. I would not
like to see PGP suceed in becoming an IETF standard but be abandoned for
failure to meet.
Have not read the whole thing yet but do not see any requirement for key escrow
or recovery, most onerous is DES/Triple-DES but that should be something already
in consideration as an add-in.
Warmly,
Padgett