Stuart,
At this point in the process, the goal is to get the current
PEM specs out with as little modification and accompanying testing as
possible. Thus the PEM WG adopted the simplest approach to avoiding
the vulnerabity you and Virgil cited, plus one cited by Charlie
Kaufman at DEC (in the public key context), namely removing MAC from
the algorithms list. Since MAC is not a good hash function anyway,
and since we really hated to have to warn users about using MAC only
for single-addressee messages, this simplifies the situation and
removes an historical artifact.
Steve