ESKM can be used to sign and encrypt emails sent using Gmail. The workspace admin should get the private key of the S/MIME certificate encrypted for each user by submitting a privileged wrap request to ESKM. This wrapped private key can then be configured in Google by following the steps here: https://support.google.com/a/answer/13069736?sjid=9318445332644748151-NC.