Subject: [openpgp] Signing Email Headers

From: Nicholas Cole <[email-masked]>
Date: Wed, 18 Mar 2015 09:46:45 +0000

One issue that comes up again and again is the question of signed
email headers.  Isn't there an obvious solution -- nest an email
message within a PGP/MIME message -- complete with the headers that
you want to protect?

Message gateways could still add headers as usual as the message went
across the net, and of course the To: and From: lines etc. would need
to be on the outer message as well, but client software could warn
users if (for example) the subject line had been changed or the To and
>From lines were different.

N.

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Wed, 18 Mar 2015 07:49:07 -0400

> message within a PGP/MIME message -- complete with the headers that

Please see the thread in this working group titled "Encrypting / Signing
the mail subject?" from the last several days for this very topic,
including a proposal that should be simpler for non-compliant MUAs to
handle than a full embedded e-mail message, while still providing the
features you're looking to add.

       --dkg

---

From: Nicholas Cole <[email-masked]>
Date: Wed, 18 Mar 2015 11:58:31 +0000

> features you're looking to add.

Thanks. Sorry. I missed that thread.