But you can also get your X.509 cert signed by a public CA and then anyone on the internet can verify your S/MIME signed email.
In practice I've only seen this in government and government contractors, but I'm sure it is done else where.
The flaws with the above approach.
1. Smaller adoption that OpenPGP
2. You normally cannot encrypt outside your organization because their is no method for key discovery. Though if you received a signed message in the past, I believe you can use that.
3. Using pubic CA infrastructure means any trusted Public CA can impersonate anyone.
The OpenPGP CA solves all these problems because pgp Web Key Directory (WKD) and that is automatically scoped to domains.
Looking forward to using this.. Although in my case the source of thruth wouldn't be openpgp keys but perhaps wireguard keys to our vpn or maybe omemo or ssh keys.
OpenPGP can becope usable in a scope of a realistically large organization, and most of the hassle can be put on the shoulders of dedicated IT people, instead of every user.
