Encrypted email versus HTTPS

["JK" <johnking@xxxxxxx>]

All,

 This may be borderline OT for this group, but was wondering whether anyone
would share their experiences about sending encrypted data via email from
the iSeries.

 For years our service bureau has crunched data and delivered the results to
many desktops at several dozen different business partners. The jobs run
automatically and use qtmmsendmail to send .pdf, .xls, .csv, etc. as MIME
attachments. We're at V5R3.

 Now, due to the "Full Employment for Lawyers and Auditors Act of 2002"
(a.k.a. Sarbanes-Oxley) our main client is requiring all communications to
be 'secure'. Without completely reworking the business procedures, I see two
options: 1) Use PGP or S/MIME to encrypt the attachments, or 2) Email a
'link' to our website, challenge the user for a userid/pw and use HTTPS to
allow the download.

 The advantage of encrypted email is there is no possibility of the user
accidentally retrieving an incorrect file from our website. The disadvantage
is that I'm not looking forward to educating dozens of not-so-sophisticated
users and listening to their complaints when they lose their encryption
keys.

 The disadvantage of a website link such as
"https://www.myserver.com/docs/somedocument.pdf"; is ensuring a user does not
accidentally or purposely mangle the link and thereby retrieve someone
else's document. Could the solution be as simple as appending a hash# to the
document id?

 Or maybe I'm missing something else really obvious? Thanks, JK