Every now and then I get educational email from companies about how to prevent phishing. Can't they just use PGP?