I always thought the best webmail would be one that uses PGP in purely browser side javascript with an open source 3rd party library, or you can disable that and do it manually if you are still worried. The fact gmail never integrated PGP shows what a fraud google is.
