Q:

Why is S/MIME (instead of PGP) recommended for such an scenario?

A large MNC with approximately 50,000 employees, and with offices in Asia, Europe and North America. This MNC operates its own PKI environment, with a self-signed Certificate Authority based at its head quarters in North America and Registration authorities distributed across the regions. Non- repudiation needs to be enforced in secure email exchanges.

A:

That's because of "enforced". PGP uses a Web of Trust which is, by nature, decentralized. To enforce things, you need some hierarchical structure with a central point of decision, which X.509 provides (in this case, through the "self-signed CA at headquarters). In the PGP model, each user is the center of his own world and cannot be dictated his trust.

