Just like mail clients block images unless you press the Show Images button, can you go one step further for 100% security, and only render emails as plaintext unless someone presses Show As HTML?
Hey! This would be pretty cool—I’ll see if we can add this in an upcoming release. I think we’d need to support HTML=>plaintext conversion on the fly since not all email sent these days has a plaintext MIME part, but not rendering HTML at all is certainly the safest thing we could do. (And also helps prevent phishing since link text and href are always the same).