I can get some meaning out of it. If I knew the context, I could get more.

May I suggest running it through HemingwayApp[1] yourself and seeing that this particular email is objectively hard to read?

Write emails (and internet comments) like the reader is a drunk 7 year old. That's about as much attention as they're giving your email.

[1] http://www.hemingwayapp.com/

You're not answering the question. What specifically is hard to understand? Formulas are just heuristics, not some ironclad objective proof of illegibility. Ironically enough, across two comments, you haven't been able to convey such substantiation.

You also haven't explained what makes it horrible rather than so-so, which is important, since it's fairly easy to make it worse. You really can't just count words and dots and call it a day.

And if someone isn't going to read an email, but ask you to repeat it verbally, they really don't belong in an office environment. I'm sure that doesn't describe you!

Specifically these two sentences are hard to understand:

     Hey the other day you said you said that the downloaded certificate is one factor, so with the password, that's already two factors, and the rotating token would be three.

     But the CTO is confused then -- how was the certificate securely transmitted in the first place, to the point that we can count it as a second factor?

They are complex sentences. This makes them hard to understand.

The email's reading level is at grade 11 on the Flesch-Kincaid scale. [1] Anything above 9 is considered "Fairly difficult to read". Best selling authors tend to score less than 9. A lot less.

You don't need to write emails like you were a best selling author of course. That's silly. But it helps if you write them for the recipient. Don't just word vomit your train of thought.

Here's how I'd write your email (from what I can guess/understand of the situation):

     Hey,

     The other day we talked about auth factors in our app. You said the certificate was one factor.
     Adding the password, that makes two. A rotating token would make three.

     Do we really need the rotating token, then?

     But the CTO is confused: how do we know the certificate transmitted securely? It can't be an auth factor if we're not sure.

     Cheers,
     ~Bla

That said, we have way over-analyzed your email :)

[1] https://en.wikipedia.org/wiki/Flesch%E2%80%93Kincaid_readabi...

[2] https://contently.com/strategist/2015/01/28/this-surprising-...

I had to read the email twice to understand it. It's absolutely hard to read.

At a minimum, each sentence is doing too much.

My lead is like that. When I send him instructions on how to do something, he always asks me to sit with him and walk him through them rather than attempting to follow them and then asking questions if he gets stuck.