In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people don't believe that they have secrets that they want to keep from others, or from the government, which would make encryption necessary. How would you explain to a person who is not into security & encryption "for its own sake" (and who isn't totally paranoid) why they would want to have encryption & digital signing in their toolkit of things they can do with their computer?
I think the others covered signing already pretty well, so I'll present my thoughts on encryption.
Possible Reasons for encryption for everyday people
They would (or should) want it because pretty much nobody has nothing to hide. It doesn't have to be anything illegal. If people really think about it, they can come up with an embarrassing secret they do not want just anybody to know about (sex?, drugs?, health? money? discussing my little pony fanfic?). Encryption also might help reduce the effects of stalking.
Or because even innocent mails might sound different to other people (wife/husband, intelligent agency, police, etc), especially if not the whole context is given (for example a quick follow-up to an in-person discussion). Encryption might be easier than trying to put the information in context afterwards.
If they are politically motivated, they might also encrypt to raise the percentage of encrypted mail. If only people who do something illegal (or cheat, etc) encrypt, encryption attracts attention. But if enough innocent mail is encrypted as well, this assumption happens less.
They might also do it because they have to (requirement of their recipient, job requirement, etc).
For most people, these are not good enough reasons, so even if encryption was a lot easier, not a lot of people would do it (except maybe if it was the default in all mail programs, etc).
See also here for examples of sensitive information which should be encrypted and might convince some people.
Who might read their mail
I think everyday people (people who are not "totally paranoid") need to be aware of who might read their mail. It doesn't have to be the government (most everyday people would handwave this away - either as conspiracy theory or something we cannot prevent anyways). But maybe their nosy parents, siblings, roommates, partner, guest, etc. who go to their computer and see that they were not logged out of gmail. Or the creepy neighbor attacking the w-lan hoping to find naught pictures in mail-attachments. Or a criminal hoping for credit card informations. I think if they think about the who more than the what, people might be easier persuaded.
Also, I think one of the main hurdles is that even if people do decide that they want to encrypt, they need to convince all of their recipients to set up encryption themselves. And if they are only a little convinced that they need encryption, it will be extremely hard for them to convince others.
- Do you want your bank details stolen and all the money in your account removed? No? You need encryption.
- Do you want anyone to alter your emails so they say something rude/incriminatory/racist? No? You need encryption.
- Do you want people to use your network or PC to download or store illegal materials? No? You need encryption.
- Do you want crooks to hijack your connection to Amazon and use your account to buy porn? No? You need encryption.
Sure, there are a lot of other controls, but encryption is used every day to help protect you. Generally https is the one most non-technical folks will recognise, but you should also be aware of encrypted file stores, databases etc.
Even a simple user doesn't think that he needs encryption , but he actually does because sometimes and i say "sometime" , those simple messages can show the psychology of a person which can leads to exploiting them in anyway you want . also as stated above encryption validates the identity of the person you're talking to .
You need encryption if you don't want your sexts and other "naughty" messages becoming water cooler topics at the NSA's HQ.
Not a very detailed answer, but in my opinion that's the most important problem for someone that has nothing to hide (about the other risks mentioned in the other answers - how many times did your neighbor attack your WLAN and tried to spy on you ? Probably zero. How many times an attacker tried to look at your mail for personal information ? You don't know but probably not many. How many of your texts the NSA read ? Maybe all of them).
There's two things encryption does:
- it makes interception of communications harder.
Text sent in the clear is trivially easy to 'pick up' by anyone on the communication path you're using. If you 'have nothing to hide' then this may seem irrelevant, but bear in mind that there are plenty of unscrupulous types out there who are prepared to use personal information for fraudulent purposes.
The necessity for this should be more obvious when talking about e.g. usernames and passwords for online banking, or email accounts.
- increases the likelihood that you're talking to who you think you are.
Some modes of encryption use public-private key pairs, or stronger verification mechanisms. SSL when talking to a website probably has a certificate that's signed by a certificate authority.
When using ssh, the first time you save a 'host fingerprint' for the remote host - the second time, if that host fingerprint has changed, it will warn you that you're talking to a different server.
Now these aren't perfect security measures, but are quite low impact to implement, and provide mitigation against a low level of risk. Just because a determined thief can kick your back door in, doesn't mean you leave it unlocked, right?
I think everyone should run their own mail servers (non-locally, of course). However, barring that (and the security risks from faulty software), it's just a good idea to have all information that is on a stranger/untrusted party's computer be encrypted. That information is stored for a long time (with gmail, forever), so 10+ years in the future, things may be different, someone you really don't trust may get a hold of that information. That private information could end up being public information.
I don't think PGP is really difficult, I just think it's explained poorly. It's worth learning. Once you figure it out, it's pretty simple. Although manually encrypting everything you send and having the receiver manually decrypt it is a bit of a pain and no one wants to do that.
When average internet users waive off the fact that multiple three letter agency's can view their data, they do so most of the time (in my experience) because they feel as though they have nothing to hide or anonymize, while forgetting one of the most important factors to take into mass surveillance and that being that the people who run these data collection programs are just that; people. So who's to say that someone with access such as Edward Snowden had wouldn't break a few rules or steal someone's information for their own personal gain, whether that be collecting vital personal information that they can later use for whatever reason or stealing credit card, bank or S.S. information. You're supposed to be able to trust your government but as everyone knows, that's not always the smartest thing to do.