If I move an agent from Waterdeep Harbour and complete a quest which allows me to return agents to my pool, can I assign those agents again this round? 

If so, can these agents be placed in the harbour?


Question: Can I expect my e-mail to be routed securely?
Answer: The SMTP servers may (probably will) still transfer the email as plain text. Sometimes SSL is used, but you cannot count on this being the case unless you specifically know the configuration of the specific servers on both ends. This means that in your scenario, an adversary capable of monitoring Internet backbone traffic could intercept the email. (Generally adversaries with this level of capability are state actors.)

SSL is still important on both ends to protect account credentials, and it will protect you against adversaries monitoring the traffic on your local network. Many attacks are going to be at this level - someone on the same wireless network as you, for instance, or who has compromised a local server on your LAN. However, SSL will do nothing to protect you against a compromised SMTP server. Message-level encryption is required if you want to avoid any transmission of the message in plaintext, and importantly means that the message will not be stored in plaintext on either server. For non-state adversaries this is the biggest attack vector - just compromise the SMTP server on either end and you can read all the plaintext mail even if every transmission along the way used SSL.

S/MIME and PGP (GnuPG) are the two standards for doing this. Even then, the message envelope will be visible. You cannot prevent an adversary who can sniff the traffic between the SMTP servers from reading the envelope, so they would know things such as the to, from, and subject line.

To directly answer your question, both parties using SSL to send and retrieve their email does improve your security - and it improves your security versus non-state adversaries a lot - but to secure the message content as much as possible you should use message-level encryption to fully encrypt the message body, and accept that the email headers will still be transmitted in the clear. An adversary capable of seeing the traffic between the SMTP servers would still be able to tell who you were emailing and what the subject line was - there's no way around that besides "don't use email" - but they would not be able to read the body of the message.