Ask him to create a PGP key. If he says no, fuck em. There are enough competing vendors for most products that you don't have to reward someone who doesn't take your security seriously. Most people don't use PGP. I've heard different numbers from different vendors, but it seems like in general about 80% of people don't encrypt their addresses. Not everyone that buys on the market is on this forum. Probably the people on this forum are more engaged and willing to learn, and the people who post in this Security section are the most security conscious, so you're getting a biased view of the security of the average SR user. Some don't even use Tor. They point a regular browser at onion.to and access the site that way. Some of them "Like" the fake Silk Road Facebook page. Some of them talk about their drug purchases on reddit, while openly admitting they are accessing it over clearnet. It's pretty clear that a certain percentage of SR users are complete idiots. As one vendor told me, "I'm amazed they managed to find a hidden service." You're free to do what you want, but I have backed out of orders because there was no PGP key.