How do you see the GPG/PGP feature ? Something working on the server or on the client ?
Server side GPG requires quite a bit of trust on the part of the user. *Especially* in the USA. The only way the user can ensure privacy is to do it on the client side. I would not want to promote a solution that hands the keys over to an email provider that can be ordered to intercept *and* not be allowed to notify the end user.
List info: http://lists.roundcube.net/dev/