Disclamer: I speak for myself and not for MIT or any other
organization.
I've heard (and read) that PKP refuses to sell licenses for PGP, so
that is out. Using RSAREF may be possible, but I'm not sure that
RSAREF gives you a fine-enough API to use it well. (I haven't really
looked into this, so it may very well be possible to do this. I'd
be interested to find out).
One good thing about PGP is the issue of trust. I don't have to trust
any root keys, rather I only have to trust my own, and then I can sign
others' keys, and trust them, and so on to create a "web of trust",
which allows multiple trust paths between users.
-derek