There's also a bit of a catch-22: if you start a company that provides secure email (for example) then I'm not going to pay you for it because I don't believe that you can provide me with secure email. The only way for that to happen is if I use GPG or similar myself and take total control.
So, I'd be concerned that the very people who might worry about this stuff are the very people who aren't going to pay you for the service.
Sure, I don't know. But I bet its bigger than ever. For instance the very popular (rank 2), mainstream German online new page SPON has a DIY Tor router article on the front page today http://translate.google.com/translate?sl=auto&tl=en&js=n&pre... (How about selling those in a way that they work out-of-the-box with a nice housing?)
If someone really wanted to find out, a little marketing study (questionnaire) might be quite revealing. E.g. "Would you pay $100 a year for /a encrypted eMail service/?"
Its true, that you can easily get into a catch-22 with the requirements of security (e.g. open source). But I'm sure the current state could be improved by someone clever. If it was trivial, there would be no startup opportunity.