Is it legal for commercial companies to use PGP?