Best practice is to use a different means for sending the key file and password, eg. email the file and call to tell them their password, or physically hand them a USB with their key and tell them their password in person.

Did this answer your question?