Whilst you're completely right (don't trust companies, pgp if you need to), I feel obliged to point out Lavabit [1] and Silent Circle [2].

Of course, you should still not trust companies, but exceptions to the rule have existed.

[1]: https://en.wikipedia.org/wiki/Lavabit [2]: https://en.wikipedia.org/wiki/Silent_Circle_(software)