title: Exactly what all subsections does protonmail.com uses to formulate the final PGP signature?
body: <p>What all subsections of the raw email does protonmail.com encapsulate to formulate the PGP signature?</p>
  <p>I researched a bit and stumbled upon this Q&amp;A thread which describes what all email subsections are signed to formulate the standard PGP signature.</p>
  <p><a href="https://stackoverflow.com/questions/7891263/sign-a-multipart-mail-using-pgp-mime">Sign a multipart mail using PGP/MIME</a>.</p>
  <p>I also read through the RFC3156 standard that describes the PGP email format.</p>
  <p><a href="https://www.rfc-editor.org/rfc/rfc3156" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc3156</a></p>
  <p>With all of that information, I assumed that I would swiftly be able to verify emails on the client side using just Openpgpjs, but alas... it didn't work as expected.</p>
  <p>I've curated a test fiddle just so that I quickly verify various mime boundaries/subsections of the email against the respective PGP signature.</p>
  <p><a href="https://jsfiddle.net/xrdvbhaw/2/" rel="nofollow noreferrer">https://jsfiddle.net/xrdvbhaw/2/</a></p>
  <p>This is the function that carries out the signature verification at the client-side:</p>
  <pre><code>openpgp.verify(options).then(function(verified) {
      validity = verified.signatures[0].valid; // true
      if (validity) {
          _(&quot;#result&quot;).innerText = 'Signed by key id ' + verified.signatures[0].keyid.toHex();
      }
      else
          console.log(verified);
      _(&quot;#result&quot;).innerText = &quot;Failed. Check log.&quot;
  });
  </code></pre>
  <p>Due to privacy concerns, I'm afraid I would not be able to share any sample data from my end.</p>
  <p>It would be nice if someone could test with the code fiddle at their end and let me know what all subsections of the raw email does Protonmail.com service use to formulate the signature so that I can verify regular protonmail.com signed emails using the same mime boundaries at the client-side.</p>