In PGP and S/MIME, the ciphertext is signed. You don't encrypt a signed message, you sign an encrypted message. You can't take a signed message that was encryp

In PGP and S/MIME, the ciphertext is signed. You don't encrypt a signed message, you sign an encrypted message. You can't take a signed message that was encrypted with your public key, decrypt it, re-encrypt it with somebody elses public key, and expect it to still appear signed by the original sender when the new recipient decrypts it. [edit] There are of course serious problems with the lack of header signing/encryption and replay attacks though I agree. Hence why I add a small note at the end of all of the pgp signed comments on my blog: "This signed text was written for https://grepular.com/ https://grepular.com/ only"