I've been asked to configure webmail for a company whose business is centred around their intellectual property - which is the rationale why we're using webmail, and not a client based email reader to access an internal only IMAP server. The other constaint is the requirement for PGP/GPG support, of which there seems to be a dearth of webmail systems that support it.
I do like the 'ooh shiny'ness of Roundcube (and the perhaps non-tech savvy end users would like it as well), however the patches for GPG support seem to be somewhat outdated. The natural choice seems to be Horde's IMP, however the code seems large, unwieldy, and perhaps no as secure as desired (due to their history of vulnerabilites).
Do you have a better suggestion of a secure webmail system which does have PGP support, or perhaps a more secure system design?