Yes! Again, this is precisely why the extra layer was added (and what I went
to great lengths to try to detail in my original response); the only
difference between what you're doing and what MIME-PEM calls for is the name
of the primary type that's used.
I accidentally substituted application/pem-clear for message/pem-clear.
Good -- then I understand how MIME-PEM works but now I've lost
sight, once again, of why changing the CTE may result in an invalid MIC!
The CTE on the application/pem-encrypted or message/pem-clear is what gets
changed and that CTE is never subject to the MIC computation.
-Ray