We eventually did set up the autoreply, after noticing that we had missed several months of emails to security@.

Also, remove the suggestion to use GPG, because this is a huge pain for everyone and it provides very little value now that TLS is ubiquitous.