I assume that there is no way for userA to inject mail as userB into the system (as you can using SMTP, for example). If you cannot gaurantee this, then you are just signing that you think the user who generated this message is userB.
The closer you can put the signing to the user, the less likely someone else was able to inject a bogus message into the stream, and the more confidence you can have in the signature.
--MidLifeXis
In reply to Re: Automatically signing outgoing email
by MidLifeXis
in thread Automatically signing outgoing email
by mpeppler
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |