We have pgp support, but should also support s/mime emails
as well.

I would expect the following:

  roundup can decrypt/store s/mine email encrypted with the key
    of the roundup instance (tracker)

  the roundup tracker can be accessed via multiple email addresses,
    the software should be able to use 1 key/cert pair for all email
    addresses up to 1 key/cert pair for each email address. This
    would allow email to the "security@example.com" address to set
    a "not_public" field on the issue to prevent public viewing of
    the issue while the normal issues@example.com can handle public
    issue submission.

  the tracker should be able to sign outgoing emails

  the user should be able to upload an smime cert to be used to send
    encrypted email from the tracker to the user

  I am not quite sure what else the current pgp code supports,
    but smime should support the same things where possible.

Hi John,
pyme which is used and then uses gpgme and Gnupg, should be able
to do CMS (for S/MIME) just as well. The emails may need to be
read a little bit different, but it should be doable with the same
backend.
Bernhard

I'm interested in this as well. At the very least, it would be nice if
the tracker didn't add .p7s attachments to tickets when one responds
with an s/mime signed e-mail.

Jason, to ignore .p7s attachements should be a lot easier
than to really parse and read the emails. :)
I suggest you open another issue for it, so we can discuss solutions
there separately. 

Best,
Bernhard