> Thou shalt not sign arbitrary plaintext Really I am not an expert in this field, but As far as I can tell signing arbitrary plaintext is a core mechanism in

> Thou shalt not sign arbitrary plaintext Really I am not an expert in this field, but As far as I can tell signing arbitrary plaintext is a core mechanism in how public key auth works. The theory is you have to sign something to prove your identity. this thing you sign has to be provided by the authenticating body and should only ever be used once to prevent replay attacks. that is you never want a situation where someone can give you a copy of the signed message and login. For example, and the only one I have actually read the standard, during auth ssh signs a number of fields, the critical one being the session id. the session id is provided by the server and is only used once, thus satisfying this critical part of public key auth.