+# when showing the message, was any or all of it decrypted?
+msgdecstatus: "full"|"partial"
+
+# The overall cryptographic state of the message as a whole:
+crypto = {
+ signed?: {
+ status: sigstatus,
+ # was the set of signatures described under encrypted cover?
+ encrypted: bool,
+ # which of the headers is covered by sigstatus?
+ headers: [header_name*]
+ },
+ decrypted?: {
+ status: msgdecstatus,
+ # map encrypted headers that differed from the outside headers.
+ # the value of each item in the map is what that field showed externally
+ # (maybe null if it was not present in the external headers).
+ header-mask: { header_name*: string|null }
+ }
+}
+