We have pgp support, but should also support s/mime emails
as well.

I would expect the following:

  roundup can decrypt/store s/mine email encrypted with the key
    of the roundup instance (tracker)

  the roundup tracker can be accessed via multiple email addresses,
    the software should be able to use 1 key/cert pair for all email
    addresses up to 1 key/cert pair for each email address. This
    would allow email to the "security@example.com" address to set
    a "not_public" field on the issue to prevent public viewing of
    the issue while the normal issues@example.com can handle public
    issue submission.

  the tracker should be able to sign outgoing emails

  the user should be able to upload an smime cert to be used to send
    encrypted email from the tracker to the user

  I am not quite sure what else the current pgp code supports,
    but smime should support the same things where possible.