https://github.com/openpgpjs/openpgpjs
Would be one approach. Or, as a link is sent "out of band", I suppose one could simply provide a symmetric key in the email. Not as secure - but might be sufficient.