Legit request, but hard on you to implement unless they provide you access to their corporate solution. A lot of them will have "secure reply" functionality do you can probably ask them to send you an empty encrypted message, and use the secure reply to respond to them with confidential info...