@aral @EU_Commission - you mean this EU Commission, that runs their webiste via Amazon Cloudfront with Amazon issued SSL certificate?

The same, that routes their emails via Proofpoint cybersecurity company based in California and owned by private equity firm.

(Yes - every email sent to or from major European regulatory body, goes thru servers owned by American company /localized in Netherlands/. If both ends don't use PGP - in plain text, plainly readable to whoever have access there)