Dear Maintainer,

This is slightly similar to #838601 (but I can't repro that particular
issue, since my MUA encodes in UTF-8) and #804421 (but that's wider).

Every time I submit a bug, I get at least one forensic report from
strikemail now. This has started to happen on the 28th of February,
so I'm assuming some strikemail user subscribed to the distro list.

I'm attaching the reports, but they're all on calls from bendel.d.o,
and every mail to submit@ has its subject rewritten to
"Bug#{...}: {original subject}", so I'm happy to say that this is what
breaks the DKIM signature.

Since the majority of those bugs (also looking at #830865 which would
also probably be fixed by this, since I have a separate chain of
forensic reports for #1021709 which Cc:ed debian-doc@lists.debian.org)
are from before 2016, there's a new solution to this exact problem,
published in RFC 8617:
https://www.rfc-editor.org/rfc/rfc8617.html
and here's an official overview PDF:
https://dmarc.org/presentations/ARC-Overview-2016Q3-v01.pdf

It appears to me that the entire point of ARC is precisely for
submit@-like lists which add stuff into the subject &a. ‒
instead of overriding/stripping the original DKIM signature,
it appends new signatures for the updated mail.

Please consider this or some other solution to bugs.d.o distributing
counterfeit mail with broken signatures.

Best,
наб

Control: tag -1 wontfix
Control: retitle -1 Add ARC signatures to outgoing mail

Thanks for the report; I've unsubscribed the user in question.

As far as ARC signing, because it's not widely supported (the RFC is
still experimental) it's unlikely to fix this particular issue. [Once it
is more widely supported, I wouldn't be against adding support, but I
don't think it's worth the effort now.]

If we want to support DKIM we're going to have to do from rewriting, and
I've been resisting doing that for a while.