PGP in Practice, Part 4: Sending encrypted email from Apple Mail / iCloud

The macOS PGP story is GPG Suite (formerly GPGTools), an open-source bundle that ships:

• GPGMail — a Mail.app plugin that adds encrypt / sign toolbar buttons to compose and verification UI to receive.
• GPG Keychain — a Cocoa app for managing keys, separate from macOS's own Keychain.app.
• GPGServices — a Services-menu integration so you can right-click any selected text or file and encrypt / decrypt / sign in place.
• MacGPG2 — the actual gpg binary (GnuPG), bundled and signed for macOS.
• pinentry-mac — the passphrase prompt that integrates with macOS Keychain so the system can offer to remember your passphrase between sessions.

A note on cost. GPG Suite is free for older macOS versions but operates on a paid annual support model for Apple Mail integration on the current macOS. The pricing changes; check gpgtools.org for the current state. The non-Mail components (Keychain, gpg, Services) remain free even when GPGMail is paid. If you don't want to pay, your alternatives on macOS are Thunderbird (Part 2), or using the gpg CLI plus a different mail client.

Download the installer from gpgtools.org, verify the signature on the package against the published one (the GPGTools team signs releases), and run the installer. macOS Gatekeeper will prompt you to allow the package; on Sequoia and later you may need to grant Mail.app permission in System Settings → Privacy & Security → Mail Plug-ins.

Restart Mail.app. If the installation succeeded, GPGMail's lock and signature icons appear in compose-window toolbars and a "GPGMail" menu appears in Mail.app's preferences.

gpg --version should now work in Terminal — that's the GPG Suite binary on PATH. If not, the GPG Suite installer adds /usr/local/MacGPG2/bin to for new shells; restart Terminal.