verify signed messages

[tomholub]

This is part of #275. Sister issues on Android: FlowCrypt/flowcrypt-android#1096 and FlowCrypt/flowcrypt-android#1097. First need to do #609

[tomholub]

Here, before loading the message, we'd pull public keys from local contacts that are recorded for the email that we received the message from (the sender email). Then offer these to the verification method as possible public keys it was signed with, into Core.parseDecryptMsg.

Then render the result, similar to what browser does.

[tomholub]

As an overview, there can be three states that you get back:

• valid signature - Signed by \(signingPubkey.primaryUserIdEmail)
• invalid signature or expired public key or something like that Bad signature - cannot trust authenticity of this message
• missing public key - Signature not verified - unknown sender public key

I don't know where to render it. Maybe above the message. It has to look different than the message itself, so that I can't send someone an email where I type out Singed by ... on top in a way that could confuse the recipient.

[sosnovsky]

@tomholub how should Core.parseDecryptMsg respond if app sends invalid pub keys in verificationPubkeys array?
I tried to send test array ["0000"] and thought it would return error, but I got successfully decrypted message.

[tomholub]

Best would be for it to still decrypt (as it does now) but show some error on the signature verification result of the response.