I personally think security has been spoiled by unrealistic advice. "Use PGP" is the worst, but it's not alone. A few years ago a mass-market device (tens of millions sold) asked me to enter my password three times within two minutes in order to carry out one single operation, and it demanded that the password be secure enough that I needed two kinds of mode-shift to enter it on that device's keyboard. Who takes that vendor's ideas about security seriously after experiencing shit like that?