> It needs to be robust, in continuity with existing infrastructure (probably domainkeys signed), straightforward (maybe signed proof of sender keys in a header

> It needs to be robust, in continuity with existing infrastructure (probably domainkeys signed), straightforward (maybe signed proof of sender keys in a header) We get fairly close here if we can get providers to DKIM-sign Autocrypt headers, like Posteo already does. E-Mail has a lot of baggage though, and we don't expect to get everything done overnight. Legacy is important, and development resources in this area are realistically very limited. Still, we feel like we have a reasonable start. > It also needs to be robust against malicious MTAs who could otherwise silently spoof senders and misrepresent their keys (double signing?). I think the best we can do here is to make providers sign keys during transit, and increase attacker risk by allowing users to verify their communications at any point.