And how do you know Tormail isn't? The whole point is that with Tor and PGP, it shouldn't matter.