[$] OpenPGP signature spoofing using HTML

Beyond just encrypting messages, and thus providing secrecy, the OpenPGPstandard also enables digitally signing messages to authenticatethe sender. Email applications and plugins usually verify thesesignatures automatically and will show whether an email contains a validsignature. However, with a surprisingly simple attack, it's often possibleto fool users by faking - or spoofing - the indication of a valid signature usingHTML email.