Messanger does not give any indication that a message it receives is signed.

Phil, How are we handling these types of security related issues in the bug system? - rhp

For mozilla, it's enough to just show the message, and ignore any signature parts. So, unless we mangle the message somehow, I'd mark this invalid since it describes a feature mozilla doesn't have. There are people working on S/MIME and PGP, but it will be some time before I expect to see any code from either group.

Following Phil's cue.

Rich, I realized I didn't answer your initial question directly: US export law prohibits us from having *encryption* code in the public code base. However, *signing* code can live in the public code base, assuming no other legal/licensing problems.

Sorry...misunderstood last comment...this won't be something we handle with Mozilla and the group that will is many months out. - rhp

To QA: when verifying this bug, just view a signed message in 5.0 to make sure that the msg looks properly and does as Phil states in the comments.

Verified with 1999-11-15-21-m11 Win32 build. Signed message received in 5.0 does not show the signature icon. Verified that the text comes through fine in the body of the message. Side note: For encrypted messages, the body of the message is blank. What would happen if someone had my public key and sent me an encrypted message? This person doesn't know I'm using 5.0. And, I won't know it's encrypted. I'll just get a message without any content. Is there any way to let the user know what's going on?

Filed bug 19064 to cover user feedback for messages we can't render