Re: rough sketch of a potential solution

>> But I'm also skeptical of this roundabout way of presenting 
>> signatures:
>> address1 signs the message, and signs a note saying "address2 is an
>> alternate for address1", and the MUA then concludes that it's safe
>> to tell the user that the message is signed by address2.
>
> The proposed logic here seems to boil down to something like this:
>
> 	   (Mallory signs message) && (Mallory signs "I'm Alice")
> 	   	=> Alice has signed message.
>

not quite what was being proposed.  it's more like

([email protected] signs message) &&
(example.com signs "[email protected] and [email protected] are the 
same")
=> [email protected] as signed message

again, if we're willing to constrain signed messages to always have a 
single author and to have the signer's public key be signed in terms of 
the fallback address, OR to use a certificate that allows alternative 
names to be associated with the public key (note that the same CA has 
to be able to make that assertion for all of those names), then I'm 
happy to dispense with the signature for alternates in the mapping 
service - as it certainly makes my proposal simpler.