Here are three small things. I didn't yet do SMIME signature verification, in case Jani wants to do that.