[mail-vet-discuss] SHOULD the header be signed?

[Scott Kitterman]

On Monday 03 December 2007 15:39, J D Falk wrote:
> Eric agreed:
> > I'm inclined to agree with the consensus.  There may be situations
> > where you verify a signature and then pass the message through an
> > untrusted environment, in which case you might want to re-sign and
> > re-verify the message, but I suspect they will be rare.  Consider that
> > this would effectively double the crypto overhead on verifiers, and it
> > really looks like making this a SHOULD is an expensive solution to
> > what will be for most people a non-problem.  I would say that it
> > should be at most a MAY.
>
> +1
>
> If it's an issue for a particular site, they can easily solve it without
> affecting anyone else.
>
> If it's not an issue for a particular site, they can easily ignore it
> without affecting anyone else.
>
I'd suggest the spec should discuss the goal (MUAs should not eat untrusted 
headers) and leave it up to local policy how to achieve that goal.

Scott K