So glad this conversation is taking place. We’re actually facing a potentially dangerous situation for one of our members and are seeing the need for an extra level of precaution, so this is timely for us. Thank you discourse! 
Generally, I approve of the way discourse uses email for transactional notifications and day-to-day, low-security engagement with the community. These don’t need to be encrypted or secure. They can and should continue to be sent in full by email, and contain meaningful context so people know what’s going on before they even log into discourse. I feel good about this, knowing that everyone expects these to be low-security.
Occasionally though there will be moments when users need to know that the message they are sending will not be transmitted by email but only accessible via discourse. Would it be feasible to create an admin enable-able “secure” feature similar to whisper, perhaps with a padlock icon to indicate security? When selected, the message would not be sent in full but rather a generic notification would be sent explaining that something is waiting for them. Like whispers, any replies to secure messages would also be sent securely and trigger similar generic notifications instead of the actual message. A warning would be provided that site admins can still read secure messages. It could also be enabled on a category-basis to provide secure discussions in private categories.
I realize these generic notifications will look suspiciously like spam/phishing a la linkedin messaging, but in combination with user education and additional contacts via other means this can work quite well. It would be used only in rare, extraordinary circumstances and only be available on sites that enable it.
Another (or additional) feature that would help is a secure messaging option in user settings, again as an admin-enabled feature. If selected, the user would only ever get generic notifications by email about pending messages. That way if they suspect their own email is being monitored they can still communicate with a reasonable level of confidence.
Oh, and FWIW I completely agree with this sentiment. GPG is impossible to rely on in our global community where we have people contributing from a wide variety of contexts (many languages, many cultural contexts, many skill levels, many types of devices and mostly mobile etc) and it would be a huge challenge to get them on GPG to help them communicate reasonably securely. I think that ship has sailed.