So Google has decided to provide end-to-end encryption for any of its Gmail users who wants it.

One could ask "what took you so long?" but that would be churlish. (Some of us were unkind enough to suspect that the reluctance might have been due to, er, commercial considerations: after all, if Gmail messages are properly encrypted, then Google's computers can't read the content in order to decide what ads to display alongside them.)

But let us be charitable and thankful for small mercies. The code for the service is out for testing and won't be made freely available until it's passed the scrutiny of the geek community, but still it's a significant moment, for which we have Edward Snowden to thank.

The technology that Google will use is public key encryption, and it's been around for a long time and publicly available ever since 1991, when Phil Zimmermann created PGP (which stands for pretty good privacy).

From then on, anyone who really wanted to communicate securely could have used PGP. The problem was (and is) that it's technically fiddly and you have to know what you're doing.

And the persons with whom you wish to communicate securely also need to know what they're doing, and have PGP software installed at their end.

Public key encryption is one of the great inventions of the 20th century. At its heart is a simple idea – that while it's trivially easy to multiply two very large numbers together, it's computationally very difficult to factorise the resulting product – ie to deduce what the original two numbers were.

Each user has two large numbers, which serve as keys – one kept private, and the other made publicly available to anyone who wishes to communicate with him or her.

PGP is terrific, but user-friendly it ain't, which is why most internet users balked at deploying it. The result was that the world's electronic communications flowed back and forth on media that were about as confidential as seaside postcards, thereby making it trivially easy for snoopers, both official and unofficial, to do their dastardly work.

Google's plan is to make PGP user-friendly by incorporating it as an extension in its Chrome browser so that encryption (and decryption) are never more than a click or two away.

In principle, it's a great idea. We will have to see how it works in practice. Users will still have to manage their private keys, both in terms of keeping them secret and being able to locate them when needed. So the private-key problem will become like our current password problem, but on steroids.

At this stage, nobody has any idea of how many Gmail users would want to use encryption, and one cynical way of interpreting the initiative is that Google is betting that it will only be a minority, so that its Adsense business will therefore be largely unaffected by it.

If that turns out to be the case then the company will be able to claim – justifiably – that it is doing good (or at any rate, not being evil) without incurring any significant financial downside. Neat, eh?

As I said, we have Edward Snowden to thank for this. His revelations about the vulnerability of the internet to surveillance has stimulated many people to recalibrate their assumptions about how the online world should be configured.

All over the place, engineers like the guys at Google have been working out ways of building serious encryption into every device and channel on the internet to reduce the vulnerabilities inherent in a system that was originally built for a community of trustworthy researchers.

The aim of the engineering community is now to put enough cryptographic treacle in the works to make the effortless superiority of the NSA et al a thing of the past. From now on, the spooks will really have to work for their money.

Underpinning all this is an assumption that if engineering ingenuity succeeds in making mass surveillance much more difficult (and expensive), then the spooks will have to become more focused – and therefore more susceptible in the end to democratic oversight and control.

I hope this assumption is correct, but I wouldn't bet on it. There was a time when we believed that PGP gave us immunity from surveillance. Technology trumped politics, we thought.

And then along came the Regulation of Investigatory Powers Act (2000) which gave the home secretary the power to demand that you handed over your encryption keys or face two years in jail. And all of a sudden, technology didn't look so omnipotent.

The encryption extension for Google Chrome will likewise be wonderful. But it won't stop agents of the home secretary from – lawfully – demanding your private key. And then we'll be back to square one. We need not just technology, but new and better laws.

This article originally appeared on guardian.co.uk