The past few years I've grown more and more concerned about the use of services like docusign. My complaints are partly because of the horrible user experience which often involves creating an account and agreeing to a long consent written entirely in legalese. But more importantly I'm concerned that they market themselves as a company that facilitates secure communication, when in reality they are just a trusted third party who could easily be compromised by the pressures of a government, or simply hacked.
For years I have just dealt with the UX when necessary, and tried half-heartedly to educate by whining to my friends and family about the problem. But we all know that nobody changes their ways without an incentive to do so. I'm proud to say that today, for the first time, I actually turned down a consulting offer because they required me to sign a contract via docusign.
Here is an excerpt.
The reason I haven't filled the contract is because of docusign. I believe strongly in cryptography and advocate for its proper use every day. In my humble opinion companies like docusign replace genuine cryptographic security with a trusted third party and serve customers who are interested in checking a legal box rather than those who genuinely care about confidentiality. I did click through to the contract planning to just do it as a pragmatic matter, but when I saw their "Electronic Record and Signature Disclosure" I couldn't bring myself to do it.
You may notice that this message is PGP signed. I hope that in the future you may consider using such cryptography without trusted third parties. I apologize that this likely disrupts your plans for the seminar.
I'm realizing, also, that if I want PGP to become much more widely adopted, I should be educating, lowering the learning curve, and improving its own UX.
-Joshy
