This, a thousand times this. I could write an entire post on the key metaphor alone. I don't think anyone has ever had their conceptual understanding improved by calling the codes you use to encrypt and decrypt things 'keys'. If we insist on calling them that, can we at least make sure to explain why it's called a key, instead of giving people the impression that it somehow works like an actual key?
I wonder whether users need to know the difference.
Seriously, the are few situations where someone's actually going to want to post their private key to the internet - at least if they understand what it is - so what are we imaging that they're doing with it that they need to know about it in the first place?
You're probably going to want them to have a backup, but you can have them make a backup without having them understand the difference - you just have your program back up a folder structure that the private key is hidden somewhere in and only make the public one obvious. Make them aware that if they don't backup they won't be able to access their emails - should the worst happen - but don't tell them why. Someone with a push-button understanding of computer... they just don't really need to know why.
... -sigh-
I almost wonder whether it wouldn't be easier to market public-private key crypto as a packaged solution. Buy an encrypted email address kind of thing. Send people a physical token they mentally associate with that email address and tell them not to lose it.
Except in other contexts, the use of the public and private keys is reversed. I use my private key to generate signatures: does it aid understanding to tell someone to use my "lock" to verify such signatures?
