A large MNC with approximately 50,000 employees, and with offices in Asia, Europe and North America. This MNC operates its own PKI environment, with a self-signed Certificate Authority based at its head quarters in North America and Registration authorities distributed across the regions. Non- repudiation needs to be enforced in secure email exchanges.
That's because of "enforced". PGP uses a Web of Trust which is, by nature, decentralized. To enforce things, you need some hierarchical structure with a central point of decision, which X.509 provides (in this case, through the "self-signed CA at headquarters). In the PGP model, each user is the center of his own world and cannot be dictated his trust.
- Certificates are based on validated trust and are more integrated into corporate mail systems
- PGP is based on "claims of trust", and support is not as wide across corporate mail systems