Opinions? I think he's got a good point and am ashamed that I overlooked
this myself, but is there a way to fix this at this late date?
Not easily, from my reading of the current draft. I think a note at the
beginning saying "this spec requires both signing and encryption
capabilities, but there are likely to be applications that only do one or
the other" is probably the cleanest way to go.
It's not like a signing-only application is going to get rejected because
it is non-conformant because it doesn't encrypt...
--Paul Hoffman, Director
--Internet Mail Consortium