We've backed into a particular default, more via path-dependencies than conscious choice, that: * emails between major email providers have this lingering semi

We've backed into a particular default, more via path-dependencies than conscious choice, that: * emails between major email providers have this lingering semi-authenticity indicator that authors didn't explicitly choose * to the extent the providers keep their DKIM keys non-public, only those providers (or those who exfiltrate such keys) can forge old emails Both of these have problems if considered from 1st principles: * Users should be able to control if they're creating non-repudiable messages. * No one, not even Google, should have the power to create authentic-seeming forgeries. This article's author, Matthew Green, suggests rapid expiration & disclosure of DKIM keys to narrow the window of time the user is subject to a non-repudiation they didn't choose. (Green here only specifically requests disclosure of years-old keys to invalidate older message archives, but conceivably a rigorous expiration-and-disclosure schedule could be chosen to limit the risk to weeks or days.) And via public disclosure, Green intends to indirectly address the risk of privileged parties forging emails, by giving everyone the same power-to-forge older emails - so no particular forgery can be too convincing. But these new defaults are nearly as ad-hoc – reactive without conscious design – as the DKIM problem they purport to solve. Many would prefer that their emails, or at least some of them, be non-repudiable for a while or indefinitely. Many recipients would like to maintain their own private authenticity records – which as Green notes, can be bootstrapped into existence (even with rapid-expiring DKIM keys) by secure-timestamping messages & current DKIM keys at the time they're received. (To the extent Google & other providers have internally-trusted tamper-proof logs, they may already have de facto secure timestamping happening on all inbound/outbound email. Thus any amount of DKIM key fouling wouldn't stop their unique internal ability to authenticate older messages, for their own forensic or political purposes.) I'd prefer users be given some visibility into, and choice over, how much durable authentication is added to their email messages – before adopting either Green's quick fix (publish old keys ASAP), or defaulting all users to his potential longer-term solution of explicitly "non-attributable email" (per his KeyForge paper or other schemes).