[9front] "Insecure" icon in gmail

["Dave MacFarlane" <driusan@driusan.net>]

I just spent more time than I care to admit trying 
to get rid of the red "Insecure" icon on emails sent 
to gmail from my 9front box. 
 
In the end, the meat of my /mail/lib/remotemail ended up 
being 
	exec /bin/upas/dkim -s 20180128 -d driusan.net >[2]/sys/log/dkim| /bin/upas/smtp -s -h driusan.net .driusan.net $addr $sender $* 
 
But I had to modify upas/smtp to *not* validate the certificate 
for startls by commenting out the okCertificate line in  
/sys/src/cmd/upas/smtp/smtp.c 
 
This doesn't seem like a great idea, but without -s remotemail 
won't use startls, and with -s the list of thumbs needs to be 
maintained for every email server on the internet in order to 
send email as far as I can tell. 
 
So I have 3 questions: 
1. Am I missing something obvious? 
2. Is there a better way to do this? 
3. Would it make sense to add a flag to use startls but not validate certificates for upas/smtp? 
 
- Dave