The concept seems to have come from the original off the record (OTR) messaging proposal. The concern was that, say, a PGP signature could create a situation wh

The concept seems to have come from the original off the record (OTR) messaging proposal. The concern was that, say, a PGP signature could create a situation where there was objective proof that someone had created a particular message. By making forgery possible the theory was that someone could disclaim the message. I have been writing some PGP fandom articles lately which is why I am up on the subject. The relevant articles: * https://articles.59.ca/doku.php?id=pgpfan:off_the_record https://articles.59.ca/doku.php?id=pgpfan:off_the_record * https://articles.59.ca/doku.php?id=pgpfan:repudiability https://articles.59.ca/doku.php?id=pgpfan:repudiability So I am not disagreeing with what you said, it supports my contention that forgability is a silly cryptographic feature if there is no proof in the first place.