And for encryption, absolutely should when in doubt. The HTML tag attack on PGP works by mixing plain and cipher text, which is a thing people might genuinely

And for encryption, absolutely should when in doubt. The HTML tag attack on PGP works by mixing plain and cipher text, which is a thing people might genuinely want to do. But the safer clients still interfered with it by re-encrypting anything which didn't begin with a PGP signature, for the very good reason that they couldn't trust mixed messages. The clients which mildly constrained inputs prevented the entire attack vector, and it looks a very good tradeoff right now.