Every protocol with algorithm agility but not a fixed list of "MUST
implement" algorithms has this issue.
Is there any reason that SSP couldn't require that anyone who makes a
statement that he signs messages must sign with all the signature algs
he supports?
This would be an SSP MUST, not a DKIM MUST.
R's,
John
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html