See T8962, somewhat. When receiving inbound mail, we could decrypt PGP messages and verify PGP signatures.

The existence of alternate ... code signing standards would motivate

This doesn't look like a bug in Phabricator; the reporting user is likely discussing client-side mail filtering rules which, by design, can never work against "Must Encrypt" mail.

Comment 3: Self mail on again.

Comment 2: Self mail off.

Comment 1: Self mail on.

(Testing "secure" flag in webhooks. 🐑)

See T13069 for followups on mail stamps.

See PHI178 and PHI126. See T12689. When users resign from a revision, they should not receive mail about it even if they're a member of a non-resigned package or project. This requires propagating mail recipients deeper into the stack, and retaining richer recipient information. Subscriptions should be upgraded to support a stronger "unsubscribe" which can get you out of indirect subscriptions via projects/packages/etc. These probably mostly go down the same pathway.

The "From" address should also probably be anonymized for flagged mail.

Who knows what the Bad People would have one if they'd intercepted it!

When an object is updated via an "inverse edge" change (normally: when it is mentioned, or when another object is linked to it) we currently do not fire Herald rules. The corresponding block in the code has this comment:

In T13053#235208, @epriestley wrote:

Hrrrm...

Hrrrm...