Check S/MIME signatures, and remember who signed

A signed message now says whether that holds up, as it is read. This is
verification only: nothing here signs, encrypts or decrypts, and the
private-key question that blocks those is untouched. Verifying needed
none of it, because the certificate travels inside the message -- which
is why this is the half that could be built.

What it checks. For multipart/signed carrying PKCS#7, the exact bytes of
the signed part -- headers included, canonicalised to CRLF -- are hashed
against the messageDigest attribute, and the signature over the signed
attributes is verified with WebCrypto against the certificate inside the
message. RSA PKCS#1 v1.5 and ECDSA over P-256/384/521, with SHA-256, 384
or 512.

The trust model is the design, and it is deliberately small. A browser
has no system trust store, and the certificate arrives inside the
message, so anyone can self-sign as anyone: on its own a good signature
shows only that the sender held the key they attached. So the word
"verified" is never rendered, and the reassuring case is not the loud
one. What carries the weight is remembering -- the first signed message
from an address pins its fingerprint, later ones are compared, and a
signer that changed is reported with both names and told to check by
another route. Trust on first use, no certificate authority anywhere.

The pins live in the account's settings rather than the browser: one
that only a single device knew would greet the same correspondent as new
everywhere else, which is how people are trained to click past the one
warning that matters. A pin records the message that created it, so the
message that established a signer keeps saying so instead of appearing
to be corroborated by itself -- without that, the very first signed
message anybody receives reads as "the same signer as before", where
before is itself. A changed, mismatched or expired signer is never
pinned, since writing the anomaly into the baseline makes every later
message agree with it.

Three things are declined rather than attempted, and all three say
"could not check" rather than "does not check out", because ignorance
and an accusation are different claims:

  - OpenPGP, by name. The signature carries no key and there is nowhere
    to get the sender's: x:PublicKey is the account's OWN registry, and
    a keyserver or WKD lookup would tell a third party who you
    correspond with -- the leak the image proxy exists to close.
  - SHA-1. Not forgeable in practice today, still not something to put a
    tick beside.
  - RSA-PSS, whose salt length lives in parameters this does not read.
    Guessing wrong would report a good signature as bad.

Nothing validates a chain: no CA bundle is shipped and revocation is not
checked. "Issued by" reports what the certificate claims, and a
self-signed one claims itself.

The DER, CMS, X.509 and MIME readers are hand-written and deliberately
narrow -- no new dependency, and the whole verifier is a lazily imported
8.6 kB chunk that a reader of unsigned mail never downloads. The one
place this is easy to get quietly wrong has its own function and its own
test: signed attributes are signed as a SET OF, not as the [0] IMPLICIT
they arrive as, and hashing the message instead would make every
signature "pass".

Tested against real `openssl smime -sign` output rather than hand-built
fixtures -- RSA, ECDSA, a tampered copy, and a valid signature by a
certificate for somebody else -- because a signed message written by
hand only agrees with whatever its author believed the format to be.
Also driven in a browser against the mock, which now serves three real
signed messages so every branch of the banner is reachable.

Translations: 34 new strings in all nine catalogues, 306 entries.
Falling back to English is unchanged at 24 per language.

web/src/locales/ja.ts

@@ -1312,6 +1312,41 @@ export const catalog: Catalog = {
     "Empty “{name}”?": "「{name}」を空にしますか？",
     "Delete them": "削除する",
     "Nothing was deleted": "何も削除されませんでした",
+    // ── Checking an S/MIME signature, and what may be said about it ──
+    "Certificate covers": "証明書の対象",
+    "Details": "詳細",
+    "Earlier messages from this address were signed by {previous}. This one is signed by {current}.": "このアドレスからの以前のメールは {previous} が署名していました。このメールの署名者は {current} です。",
+    "Fingerprint": "フィンガープリント",
+    "Hide details": "詳細を隠す",
+    "Issued by": "発行者",
+    "It is signed with OpenPGP, and ihasmail has no way to fetch the sender's public key.": "OpenPGP で署名されており、ihasmail には送信者の公開鍵を取得する手段がありません。",
+    "It uses a signature algorithm ihasmail cannot check yet.": "ihasmail がまだ検証できない署名アルゴリズムが使われています。",
+    "It was made with a certificate belonging to {name}, which does not cover this address.": "{name} の証明書で署名されており、この証明書はこのアドレスを対象にしていません。",
+    "Previous fingerprint": "以前のフィンガープリント",
+    "Signed at": "署名日時",
+    "Signed by {name} — the same signer as before.": "{name} による署名です。以前と同じ署名者です。",
+    "Signed by {name}, seen here for the first time.": "{name} による署名です。ここで見るのは初めてです。",
+    "Signer": "署名者",
+    "That can mean a renewed certificate, and it can mean somebody else. Check with them by some other route before trusting it.": "証明書を更新しただけの場合もあれば、別人の場合もあります。信頼する前に、別の手段で本人に確認してください。",
+    "The certificate has expired.": "証明書の有効期限が切れています。",
+    "The certificate is not valid yet.": "証明書はまだ有効ではありません。",
+    "The message does not match what was signed — it was altered after signing, or damaged on the way.": "メールが署名された内容と一致しません。署名後に変更されたか、途中で壊れています。",
+    "The signature carries no certificate that can be read.": "署名に読み取れる証明書が含まれていません。",
+    "The signature could not be read.": "署名を読み取れませんでした。",
+    "The signature does not match the certificate sent with it.": "署名が、一緒に送られた証明書と一致しません。",
+    "The signature is not for this sender.": "この署名はこの送信者のものではありません。",
+    "The signed part is missing either the message or the signature.": "署名された部分に、本文か署名のどちらかが欠けています。",
+    "The signer has changed.": "署名者が変わりました。",
+    "This message is signed, and ihasmail could not check the signature.": "このメールには署名がありますが、ihasmail は署名を検証できませんでした。",
+    "This signature does not check out.": "この署名は正しくありません。",
+    "Valid until": "有効期限",
+    "a different certificate": "別の証明書",
+    "an unnamed signer": "名前のない署名者",
+    "as claimed by the signer": "署名者の申告による",
+    "first seen {date}": "初回は {date}",
+    "ihasmail will tell you if a later message from this address is signed by anybody else.": "このアドレスからの以降のメールが別の人の署名だった場合、ihasmail がお知らせします。",
+    "itself, or an issuer it does not name": "自分自身、または名前のない発行者",
+    "no address": "アドレスなし",
   },
   plurals: {
     // ── Third pass ─────────────────────────────────────────────────────