UX runs deeper than software interfaces.

> Identity and key management is really the underlying issue

Yes, that's a UX issue.

So:

- Get GPG key from Facebook (which has them as part of the standard profile today)

- Say to person: you should contact this person by a means you trust and confirm this is their key (since we don't trust anyone by default).

- Once they click OK, they can now send messages to that person.

Nothing stopping other mainstream sites from adding GPG, it's jus that FB is the only one I know of. Obviously GitHub doesn't count since most people aren't software developers.