Companies are generally at more risk from failure to produce message content in a lawsuit, regulatory action, HR investigation, etc. than from eavesdropping. "Secure" in a corporate setting means subject to IT's surveillance, filtering, and archiving. If anything, security's job is to make sure employees aren't using things like PGP, personal webmail, Facebook, etc. to evade corporate retention policies.

Maybe mysterious quasi-state actors will steal your secrets and outcompete you decades from now, but they could probably do that anyway. The SEC will certainly fuck you up right now if you can't demonstrate adequate controls on regulated employees' communications.

I'm talking about personal e-mail. Still businesses can easily enforce retention policies with PGP by using a master key.

If that were viable people would already be doing it. It's not, and so very few people are. I wish this weren't the case but it is.

And how does that work for your average person using outlook / google for email?

Then build on top of email, instead of developing yet another 'secure' proprietary system.