I also set up each individual address manually (by editing the /etc/aliases file). If it receives spam, I will remove it, and the server will tell them that address doesn't exists.
I don't really trust Google to do my email, but I do not need to do so; I don't like their email software anyways, so that is why I use a different one.
- if you don’t want to trust anyone, email is a lot of work- you need your own email server and domain, and you can use the catch all option
- if you are willing to trust only google, gmail plus addresses work, but then you lose most of the security and privacy benefits, because it’s trival to deduce your email address
- if you’re willing to trust a 3rd party (in this case idbloc) then that gets you highest level of convenience & security, but you do need to trust idbloc