An intuitive and simple solution is to make sure that an automated script (malicious script) cannot try to register with a list of e-mails in order to figure out which ones are registered. For example, use CAPTCHA challenge as part of registeration to make sure it is a human trying to register an account. In this way, even if few user e-mails are tried, a massive number cannot be checked. Note we are assuming strong CAPTCHA cannot be easily broken. 

But if it is super sensitive and you must hide who is registered at the target website even from human users, then finish the registration and do not show any error message to the user that the e-mail is already registered; and just inform the user at the end of the process that now they have to confirm the e-mail belongs to them, please go and check your e-mail; In the backend, if the e-mail is already registered, then do nothing; just send an e-mail to the owner of the e-mail and inform them: seems you tried to re-register at our service again, if you have forgotten you have an account with us, this is your username, and if you cannot remember your password, go to the password reset page. To be at the safe side, you can mention that if you did not try to register with us again, please ignore this e-mail. 

If the e-mail is not registered in the database, in the backend, create a random one-time use token in a URL and send to the new e-mail registered and ask them to confirm the new account if they meant to create a new account. 

This way is you absolutely hide everything from the bad guys; 

Should you let users know if an email has been taken during registration validation?
I would like to embed some C# .Net code that does some simple Encryption/Decryption functions into a web page. This will be an internal web page so users will be implicitly trusted. Is there any way to do this? I will need to hit user's Windows-MY key store (via CAPI) to pull out the keys for decryption and hit an LDAP server to grab public keys for encryption.
