On a related note, your PGP encrypted address is rendered useless if the vendor sends you a tracking number in plaintext, because an adversary can use that number to find your address. Tracking numbers are actually worse, because addresses are deleted when the order is marked In Transit, usually within a couple of days, while tracking numbers will be stored in SR messages for 3 months, even after they are deleted. If you encrypt your address, you should instruct the vendor not to send you a tracking number, but then again, they should be smart enough to figure that out for all of their customers who encrypt their addresses.