If a bug is not private, do what we've always done.
If a bug is private, and the user has accepted to get encrypted e-mail, encrypt it. If he hasn't accepted to receive encrypted mail, send only the status change stuff (and perhaps a notification of new comments). The footer should contain a link to the place where you change your "accept encrypted e-mail" setting.
When implementing this, it might make sense to go through all the bug mail that malone has received, find the GPG signed e-mails and set "accept encrypted e-mail" for the senders to "on" as they clearly have used gpg before and are likely to be able to use it. Also, when a user sends his first gpg signed e-mail to malone, this setting should be set to "on".
How about this:
If a bug is not private, do what we've always done.
If a bug is private, and the user has accepted to get encrypted e-mail, encrypt it. If he hasn't accepted to receive encrypted mail, send only the status change stuff (and perhaps a notification of new comments). The footer should contain a link to the place where you change your "accept encrypted e-mail" setting.
When implementing this, it might make sense to go through all the bug mail that malone has received, find the GPG signed e-mails and set "accept encrypted e-mail" for the senders to "on" as they clearly have used gpg before and are likely to be able to use it. Also, when a user sends his first gpg signed e-mail to malone, this setting should be set to "on".