I hope there is a big warning when using the app, because this makes these emails (maybe even the whole conversation chain?) wortheless should they be needed as some kind of legal evidence.
I hope there is a big warning when using the app, because this makes these emails (maybe even the whole conversation chain?) wortheless should they be needed as some kind of legal evidence.
IMAP is really kinda a object store, where the objects are emails. Modify emails stored remotely is already extremely trivial.
DKIM and ARC make this a bit more secure, but they are the only way to validate an email is authentic.
DKIM key rotation with providers like AWS SES and others, after a period of time it is impossible to validate old emails as authentic. For SES it takes only 9 months for that to happen.
The provider has no reason to keep either the public or private key either.
Of course you would need multiple trusted sources for the key to have confidence that the mail is legit.
Frustratingly, Exchange breaks this possibility immediately, because it decomposes the email into components. It does preserve and validate some fancier signature schemes, but those are rarely used and have their own problems.