There are several challenges in transposing the "read receipt" concept to the world of emails. An important point to make is that read receipts are legal weapons aimed at the recipient; they are meant to be used as proofs, during some litigation against the recipient, that he indeed received it and thus can be presumed to have been aware of the message contents. The recipient is then the attacker, the villain in our story. We cannot expect his full collaboration.
There are two distinct scenarios here: the recipient might be interested in the message contents, or he might not be (for instance, he might expect a legally heavy notification and will not want to touch it with a 10 feet pole).
Let's see what happens with classical mail:
- The sender (let's call him Stuart) wants to send an important message to the recipient (Robert), and wishes to obtain a receipt that, should the worst happen, will be flourished by Stuart's lawyer during a subsequent trial, as a proof of Robert's duplicity.
- Stuart writes the letter and trusts it into the care of the local Postal service.
- The letter ultimately comes into the hands of the postman (sorry, the mail-delivery person) who will knock at Robert's door.
- If Robert answers, he will have to sign a receipt, under the supervision of the postman. The postman will not give him the letter until he has signed. If Robert is not present, the postman will leave a notice in Robert's mailbox, and Robert will go fetch his letter as the Post office; a similar signature procedure will take place there, with the office clerk.
- The receipt is again transferred back to Stuart by the Postal service.
The postman is rather central in the whole procedure. Let's see what he does:
Until he has signed the receipt, Robert has no knowledge of the message contents. This whole process assumes that the Postal service is trustworthy and ensures total mail confidentiality over the entire transit of the message. This property does not translate well to emails, because emails may travel unencrypted over the wires; PGP encryption with Robert's public key would not help, because in our scenario Robert is the eavesdropper.
In the classic mail scenario, when the postman faces Robert, the postman is the Master of Ceremony: he ensures that Robert will not get the letter until he has signed the receipt, but he also ensures that Robert will get the letter if he has signed the receipt. When Robert is on the verge of signing, the letter is already on the premises; there is very little risk of losing it. Even if a really freak event occurred (e.g. a stray dog deftly snatches the letter from the hands of the postman and runs away with it), the postman would know it, and cancel the receipt. Also, Robert, by signing the receipt, shows that he is awake, understands what is going on, and is generally in full possession of his legal abilities. All of this occurs under the eyes of the postman, who could testify about the proceedings.
These characteristics allow the judiciary power to assume that if Robert signed the receipt, then he did receive the message. Reading the message is his responsibility; Robert will be considered as having read it (if he wants to claim otherwise, the burden of proof will be on him).
Electronic communications do not allow for such simultaneity. In email delivery protocols, like IMAP, POP or all the Webmail reader engines, there are only two possibilities: either the the recipient first gets the message and then acknowledges reception, or the recipient first sends the acknowledge and then obtains the message (most protocols choose the former). An honest Robert would be wont to send a signed receipt for a message he did not obtain yet and might never obtain (he has no actual guarantee that the server on the other side will not crash at that exact point); a dishonest Robert will arrange for never sending the final acknowledge, so that he could claim that his computer crashed at the wrong moment.
One partial solution is to have a trusted reliable delivery service -- a virtual postman, really. That is a service which will be imbued with all the official blessings that can be bestowed upon an administrative organization by the State; its mission is to deliver messages, but also to keep copies for a long time (say, three months). Honest Robert would agree to send a signed receipt to the Virtual Postman because he trusts that if the VP sent him a notification, then the message exists, the VP will not lose it, and he will be able to obtain it again from the VP even if his computer catches fire and he has to buy a new one. Under these conditions, a signed receipt before delivery can be legally required from Robert. This potentially fixes the technical issues of Robert obtaining the message first. But it requires a trusted VP.
The system you describe with the message key and the nonce is of that kind; the "sender's home e-mail server" plays the role of the trusted VP. But bear in mind that the VP must be trusted by both Stuart (Stuarts need the VP to keep the message from Robert until the receipt is duly signed) and Robert (Robert needs the VP to guarantee the delivery of the message, otherwise he will not sign the advance receipt).
To have any legal validity, Robert's signature on the receipt must fulfill the characteristics required by the Law. This depends on the country and its legal framework. For classical mails, the signature's power is not really in the squiggly line that Robert draws on the paper; it is known that some good con-artists can forge signatures, and, anyway, simply verifying that the signature is correct requires training. The real force of the signature comes from, again, the postman. The postman is a witness: he saw Robert signing. Refusing to recognize one's own signature is a serious offense, which is often punished with much greater severity than whatever a letter could entail.
In the world of computers, there is no witness. Robert could claim that his computer caught a virus and was under the control of someone else; the legislator cannot realistically enforce a requirement for all citizens to have virus-free computers. If the signature mechanism is of the asymmetric cryptography persuasion, then Robert could claim that the key is not his. This is especially true of decentralized systems like PGP and its Web of Trust: at one point, I counted no less than five distinct PGP keys bearing my own email address and uploaded on key servers, none of which being mine.
For any legal value attached to the receipt signed with an asymmetric algorithm, the corresponding public key must be provably bound to the signer's legal identity. This requires a lot of legislation and a State-operated (or at least State-subsidized) PKI: vital records and citizenship are, by definition, a monopoly of the State. I seriously doubt that a State would use the OpenPGP format for that; this is more a job for a hierarchical PKI, for which OpenPGP has no specific support (hierarchical PKI is about delegation of trust and power; this entails a lot of details which can be seen in the complexity of X.509, which tries to deal with it upfront).
Robert may try to "play dead". This is hard to do with classical mail: you have to avoid the postman, hide when he rings at your door. You must not confront him because he is, as we saw, a presumed trustworthy witness. Positively refusing to sign the receipt is incriminating: it shows that you are aware that officially reading the message contents may have consequences. The bottom line is that playing dead with classical mails often equates to forfeiting mail reception altogether; this is not a ultimately tenable situation. All Roberts must yield, and sign the receipts, because the alternative is to figuratively cross the sea and then burn their vessels.
There is no such thing with emails. An email address can be dropped, since new ones are just free. It took me some effort to actually maintain my primary email address since 2001. Also, if I receive a notification telling me that an important message awaits me on some server somewhere (that I did not heard of before), then I can ignore it altogether: what does this server matter to me?
(For a substantial proportion of the population, the classical mail model could be transposed to Facebook: Facebook could be the postman, forcing the recipient to either sign the receipt, or totally abandon Facebook, an unthinkable eventuality for the millions of addicts to that site.)
This is a hard problem for which no solution exists yet; the technical tools are ready (e.g. asymmetric signature algorithms), but it also needs some infrastructure which will need official support, will be expensive, and won't be of any use until is has become so important that it cannot be ignored. This looks like a problem which will not be solved any time soon.