Presumably because RFC822 is a legacy format and there are weird implementations out there that do things (e.g. something as simple as adding a header or signat

Presumably because RFC822 is a legacy format and there are weird implementations out there that do things (e.g. something as simple as adding a header or signature!) that would mutate data used in a signature. This allows you to carve out a spot for the insecure stuff you can't otherwise get rid of. Obviously it also carves out a spot for an attacker to put their own stuff in, and thus relies on downstream parsing to not get fooled[1]. Which is terrible security design in a from-scratch system. But with legacy stuff... there often isn't a choice. Security is just hard. [1] The article isn't clear, but the closest to a root cause bug in this particular instance is actually that the mail client is validating the signature, but failing to recognize that there is unsigned data being presented to the user as part of the message. That's a tall order for client code, but that's where this particular design put the responsibility.