Users should have the option to upload a GPG public key that the forum uses to encrypt all notification emails.
Alternately or in addition to this, the forum should have native Bitmessage capability. This means letting users register with Bitmessage addresses and sending notifications through the Bitmessage network. Note that routing the notification through a honeypot gateway like bitmessage.ch doesn't count because the primary purpose of Bitmessage is to not have monitoring chokepoints with access to plaintext.
This is a toss-up. Technically we can enable the option without a problem and sensitive info like password reset links and things of the like can be sent with GPG if the users opt into it.
What's the toss-up?
I think the option to GPG encrypt all messages from the forum is a great idea.
GPG is a CPU intensive process. In most cases, this is not an issue because either messages are small or they are infrequent. But given the right circumstances, it could bog down the server and could be used as an attack vector much like DDOS or could even be paired with it (we need to make sure this is not possible). We have a lot of other features lined up that could be upsteam dependencies and we need to make sure that in all cases, the server is still responsive.
Let's take the email/GPG use case for example, if an email needed to be sent out to the entire user base. That email would have to be encrypted once per user and then sent out (Given everyone was using GPG). If there are (I'm making this number up) 100,000 users... Can you see how much work that would be for the CPUs? This would be on top of serving those same 100,000 user the forum as well. Now imagine if that email really didn't have anything important to say. That's a lot of work for really nothing. But what if the email did contain sensitive information? There are ways to mitigate the CPU issue by locking it down to a few or just one core but that comes with its own trade offs. The speed at which the emails are being sent out may be drastically lower. If the email isn't time-sensitive but contains sensitive information, this is fine. But what if a system wide breach of the DB were to occur and all user's login/pass were compromised. A time-sensitive and possibly information sensitive email needs to go out...
I could go on and on and keep playing what ifs. Each what if (corner case) does have a solution but some of them require that GPG is not universally used on all messages for the sake of speed. Which means more coding to ensure that logic is in place. Also, if none of the features run into issues like above then it's clearly a good idea to use GPG on everything.
This is why the idea of GPG on all communications is a toss up. It's a great idea and we'd love to implement it, but due to the nature of GPG being CPU intensive, we may need figure out a solution if two features align against each other. But since not all the forum features have been solidified, we can't make a firm decision on it right now. That's just the nature of software development.