I disagree entirely. It is almost entirely the customers risk if GPG is not used. Vendors are barely more vulnerable if they use GPG or not provided they take all the other required counter measures. So I think customers who do not use GPG can not be cut slack, since using GPG is almost entirely to their advantage.