> This means, a) the recipient doesn't know whether the signature is from their counterparty because that HMAC signing secret is only loosely/deniably secret, a

> This means, a) the recipient doesn't know whether the signature is from their counterparty because that HMAC signing secret is only loosely/deniably secret, and b) without a counter (another low entropy shared secret or a ratchet), there is no way of knowing whether the signed message you recieve is the "first," one derived from your shared secret. The HMAC signing key is not publicised until _after_ the recipient first/immediately verifies the signature. (This is practical for chat applications like OTR and Signal, but it would leave a much much wider window open if you tried to implement it for a much lies synchronous communication channel like email.)