> In the article they describe an attacker changing Content-Type as it's typically not signed. That seems like exactly the kind of header you'd want to ignore i

> In the article they describe an attacker changing Content-Type as it's typically not signed. That seems like exactly the kind of header you'd want to ignore if not signed. That would result in a lot of unreadable emails unfortunately. It would also take over-signing the Content-Type to mitigate this issue, having everything signed that way would certainly break even more.