Just parroting my own experience (which seems to be the the norm) In similar situations, I use GPG attachments. Usually the client has the attachment filtered to a specific folder on their local machine and run a script that provides some automation as far as decrypting the messages and processing.