[Enigmail] On signatures

[Robert J. Hansen]

Thomas Hotz wrote:
> It all boils down to trust: Do you trust the sender to keep his secret
> key and passphrase to himself?

No.  A malicious person interjecting themselves in the middle of the
conversation can add or remove elements from the message at will.  They
can't forge a good signature from a validated key, but they can add bad
signatures willy-nilly.