Re: [secdir] Last Call: draft-gennai-smime-cnipa-pec (Certified Electronic Mail) to Proposed Standard

[Sam Hartman <[e-mail]>]

I'd like to echo John's concern.  If this was not simply a case of
clicking the wrong button, then I think a longer last call
announcement explaining why the IESG believes standards track is
appropriate and why the IESG believes this document meets our criteria
for proposed standard would be in order.

Here are my initial reasons why I don't think the presumption that the
document is ready for standards track review holds in this case [1].

* The abstract claims this document describes what is done in Italy, not what should be done
* The use of mail headers, particularly from and reply-to seems likely to require review and discussion in the e-mail community
* I'm not sure this mechanism is consistent with BCP 61 or the Internet threat model.   In particular, section 5 describes several key threats but does not describe mandatory-to-implement mechanisms to meet these threats.  We'd never accept this from an IETF working group outside the security area, we shouldn't accept this from a security area document.
* The security considerations section 8 is very weak.  I think that a lot of what should belong there is actually in section 5, but even so this does not feel like an IETF document.

[1] We've had a lot of discussions about what level of consensus is
required to publish standards track documents that are individual
submissions.  However I at least believe that there's a presumption
that documents forwarded to last call by the IESG are at least ready
to be reviewed as standards track, so I feel the need to give specific
reasons why that presumption does not hold in a given case.