Why the market insists on PGP

PGP is the part of the market that people complain about the most and the part that saves them the most. The market asks every user to generate a key pair and to import the market's public key before they do much of anything, and a lot of first-time buyers find that a lot of ceremony for a shopping trip.

The reason it is required is not tradition. It is that the market needs a way to know a message came from the person who claims to have sent it, without trusting the transport. Email is not trustworthy if the account can be phished. A chat app is not trustworthy if the server can be read. An encrypted message signed by a key you already have is the only channel where the sender is provably the sender, and that is the property the whole market is built on.

What it protects against, specifically

The first failure is a fake admin. If someone can post a message that looks like it came from the market, they can tell you to move your funds, change your password, or click a link. A signature from a key you already trust kills that, because a forger would need your private key to make a message pass verification, and they do not have it.

The second failure is a replay. An old, perfectly genuine message resurfaced at a bad time can mislead you just as well as a fake one. PGP timestamps and the way the market sequences its signed posts let you tell a current instruction from a stale one, which is harder to do with an unsigned screenshot.

When it is not worth it

To be fair, if you are buying one small item and you plan to never come back, the setup cost is real. You are spending twenty minutes on a key to save a transaction that might be your only one. For a one-off buyer that is a reasonable objection. For anyone who plans to order more than once, the key pays for itself the second time, because after that the messages just work and the fear goes away.