Concerning the the "gaping security hole" of using S/MIME's
multipart/alternative approach with a remote message validation
server:
Since the remote validation server is S/MIME-aware (it is checking the
signature), then it can also check if the message it is verifying is
multipart/alternative. If it is, then it can simply confirm that the
data in the "clear" part is the same as the data inside the PKCS
part.
This would be a good thing to suggest in the S/MIME spec, thus closing
the "security hole."
- Jeff