This is a question which I am unclear on about PGP Inc's design goals in using the CMR method. Is the CMR field to allow the company to recover from the user forgetting his password? (recover his mail folder full of encrypted email). or Is the CMR field to allow the company to read the email in transit This seems like a fairly important distinction. Adam