Check RFC2634 before you abandon S/MIME. Triple wrapping solves surreptitious forwarding, which is how this attack works. Sadly AFAIK it's implemented only in Trustedbird.
"To decrypt the emails, he first manipulates their ciphertext
by using appropriate malleability gadgets." - so if you use triple wrapping as per https://www.ietf.org/rfc/rfc2634.txt you are safe. e: To make the claim more precise: you must drop messages which are not triple wrapped and those which are triple wrapped, but inner signer is different from the outer signer.
I wish there was a transcript, it was really full of interesting facts. I personally have a tinnitus so lack of sleep is big a issue for me so I identified myself with a lot of things he said. I'm happy I discovered Tryptophan lately, it really helped me to get good a quality sleep.
TLDR: Userland process' read access to Ring 0 memory will throw an exception (n.b.: kernel mode memory is actually mapped into process' address space), but before that the instruction reading the memory is actually executed and data are cached. The process can use value of data as an address in userland for another read instruction. Now the process just needs to check range of possible addresses where the data was read from and see how long it takes (using rdtsc) to access them - if it's quick, then we have a match.
Is that correct, or am I missing something? e: write changed to 2nd read
N.b. Pollan presents his subjective experience. If you liked it, you will love reports on https://www.erowid.org/ and there's a lot of information on https://psychonautwiki.org/wiki/Main_Page if you decide for firsthand experience.