S/MIME suggestions

[Bruce Stephens <bruce+gnus@cenderis.demon.co.uk>]

Just a couple of suggestions for signed email mostly.  Most user
agents don't *require* that certificates verify (i.e., you don't
*have* to have the issuer's certificate).  They complain loudly if the
certificate doesn't validate, obviously, but they allow you to trust a
specific certificate, without having to trust all certificates signed
by a particular issuer.

Openssl allows this using the -noverify flag.  So (in a pleasantly
contradictory fashion), "openssl smime -verify -noverify ..." makes
perfect sense.

Also, "openssl smime -verify ... -signer <file>" extracts the
certificate (presuming there is one).  That strikes me as a very
convenient feature to use.  Especially considering that "openssl x509
-email -noout -in <cert>.pem" prints out a list of email addresses for
the given certificate, which would presumably allow Gnus to check that
the email addresses match with the From header.