I wrote my law school note on this kind of thing. I technically excluded email from the analysis, but I wrote a lot about how contents of communications at the application layer should be protected. If you get a chance to read it, I'd be curious to know what you think.

It's here.