force your users to use PGP, don't give them an auto encrypt button. you want your users safe even after your $30/mo VPS gets seized, don't you?