diff --git a/src/keycache.cpp b/src/keycache.cpp
index 81580ae..9d6f5d2 100644
--- a/src/keycache.cpp
+++ b/src/keycache.cpp
@@ -1,1425 +1,1476 @@
 /* @file keycache.cpp
  * @brief Internal keycache
  *
  * Copyright (C) 2018 Intevation GmbH
  *
  * This file is part of GpgOL.
  *
  * GpgOL is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
  * GpgOL is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  * GNU Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include "keycache.h"
 
 #include "common.h"
 #include "cpphelp.h"
 #include "mail.h"
 
 #include <gpg-error.h>
 #include <gpgme++/context.h>
 #include <gpgme++/key.h>
 #include <gpgme++/data.h>
 #include <gpgme++/importresult.h>
 
 #include <windows.h>
 
 #include <set>
 #include <unordered_map>
 #include <sstream>
 
 GPGRT_LOCK_DEFINE (keycache_lock);
 GPGRT_LOCK_DEFINE (fpr_map_lock);
 GPGRT_LOCK_DEFINE (update_lock);
 GPGRT_LOCK_DEFINE (import_lock);
 static KeyCache* singleton = nullptr;
 
 /** At some point we need to set a limit. There
   seems to be no limit on how many recipients a mail
   can have in outlook.
 
   We would run out of resources or block.
 
   50 Threads already seems a bit excessive but
   it should really cover most legit use cases.
 */
 
 #define MAX_LOCATOR_THREADS 50
 static int s_thread_cnt;
 
 namespace
 {
   class LocateArgs
     {
       public:
         LocateArgs (const std::string& mbox, Mail *mail = nullptr):
           m_mbox (mbox),
           m_mail (mail)
         {
           TSTART;
           s_thread_cnt++;
           Mail::lockDelete ();
           if (Mail::isValidPtr (m_mail))
             {
               m_mail->incrementLocateCount ();
             }
           Mail::unlockDelete ();
           TRETURN;
         };
 
         ~LocateArgs()
         {
           TSTART;
           s_thread_cnt--;
           Mail::lockDelete ();
           if (Mail::isValidPtr (m_mail))
             {
               m_mail->decrementLocateCount ();
             }
           Mail::unlockDelete ();
           TRETURN;
         }
 
         std::string m_mbox;
         Mail *m_mail;
     };
 } // namespace
 
 typedef std::pair<std::string, GpgME::Protocol> update_arg_t;
 
 typedef std::pair<std::unique_ptr<LocateArgs>, std::string> import_arg_t;
 
 static DWORD WINAPI
 do_update (LPVOID arg)
 {
   TSTART;
   auto args = std::unique_ptr<update_arg_t> ((update_arg_t*) arg);
 
   log_debug ("%s:%s updating: \"%s\" with protocol %s",
              SRCNAME, __func__, anonstr (args->first.c_str ()),
              to_cstr (args->second));
 
   auto ctx = std::unique_ptr<GpgME::Context> (GpgME::Context::createForProtocol
                                               (args->second));
 
   if (!ctx)
     {
       TRACEPOINT;
       KeyCache::instance ()->onUpdateJobDone (args->first.c_str(),
                                               GpgME::Key ());
       TRETURN 0;
     }
 
   ctx->setKeyListMode (GpgME::KeyListMode::Local |
                        GpgME::KeyListMode::Signatures |
                        GpgME::KeyListMode::Validate |
                        GpgME::KeyListMode::WithTofu);
   GpgME::Error err;
   const auto newKey = ctx->key (args->first.c_str (), err, false);
   TRACEPOINT;
 
   if (newKey.isNull())
     {
       log_debug ("%s:%s Failed to find key for %s",
                  SRCNAME, __func__, anonstr (args->first.c_str ()));
     }
   if (err)
     {
       log_debug ("%s:%s Failed to find key for %s err: %s",
                  SRCNAME, __func__, anonstr (args->first.c_str()),
                  err.asString ());
     }
   KeyCache::instance ()->onUpdateJobDone (args->first.c_str(),
                                           newKey);
   log_debug ("%s:%s Update job done",
              SRCNAME, __func__);
   TRETURN 0;
 }
 
 static DWORD WINAPI
 do_import (LPVOID arg)
 {
   TSTART;
   auto args = std::unique_ptr<import_arg_t> ((import_arg_t*) arg);
 
   const std::string mbox = args->first->m_mbox;
 
   log_debug ("%s:%s importing for: \"%s\" with data \n%s",
              SRCNAME, __func__, anonstr (mbox.c_str ()),
              anonstr (args->second.c_str ()));
   auto ctx = std::unique_ptr<GpgME::Context> (GpgME::Context::createForProtocol
                                               (GpgME::OpenPGP));
 
   if (!ctx)
     {
       TRACEPOINT;
       TRETURN 0;
     }
   // We want to avoid unneccessary copies. The c_str will be valid
   // until args goes out of scope.
   const char *keyStr = args->second.c_str ();
   GpgME::Data data (keyStr, strlen (keyStr), /* copy */ false);
 
   if (data.type () != GpgME::Data::PGPKey)
     {
       log_debug ("%s:%s Data for: %s is not a PGP Key",
                  SRCNAME, __func__, anonstr (mbox.c_str ()));
       TRETURN 0;
     }
   data.rewind ();
 
   const auto result = ctx->importKeys (data);
 
   std::vector<std::string> fingerprints;
   for (const auto import: result.imports())
     {
       if (import.error())
         {
           log_debug ("%s:%s Error importing: %s",
                      SRCNAME, __func__, import.error().asString());
           continue;
         }
       const char *fpr = import.fingerprint ();
       if (!fpr)
         {
           TRACEPOINT;
           continue;
         }
 
       update_arg_t * update_args = new update_arg_t;
       update_args->first = std::string (fpr);
       update_args->second = GpgME::OpenPGP;
 
       // We do it blocking to be sure that when all imports
       // are done they are also part of the keycache.
       do_update ((LPVOID) update_args);
 
       fingerprints.push_back (fpr);
       log_debug ("%s:%s Imported: %s from addressbook.",
                  SRCNAME, __func__, anonstr (fpr));
     }
 
   KeyCache::instance ()->onAddrBookImportJobDone (mbox, fingerprints);
 
   log_debug ("%s:%s Import job done for: %s",
              SRCNAME, __func__, anonstr (mbox.c_str ()));
   TRETURN 0;
 }
 
 static void
 do_populate_protocol (GpgME::Protocol proto, bool secret)
 {
   log_debug ("%s:%s: Starting keylisting for proto %s",
              SRCNAME, __func__, to_cstr (proto));
   auto ctx = GpgME::Context::create (proto);
   if (!ctx)
     {
       /* Maybe PGP broken and not S/MIME */
       log_error ("%s:%s: broken installation no ctx.",
                  SRCNAME, __func__);
       TRETURN;
     }
 
   ctx->setKeyListMode (GpgME::KeyListMode::Local |
                        GpgME::KeyListMode::Validate);
   ctx->setOffline (true);
   GpgME::Error err;
 
    if ((err = ctx->startKeyListing ((const char*)nullptr, secret)))
     {
       log_error ("%s:%s: Failed to start keylisting err: %i: %s",
                  SRCNAME, __func__, err.code (), err.asString());
       TRETURN;
     }
 
   while (!err)
     {
       const auto key = ctx->nextKey(err);
       if (err || key.isNull())
         {
           TRACEPOINT;
           break;
         }
       KeyCache::instance()->onUpdateJobDone (key.primaryFingerprint(),
                                              key);
 
     }
   TRETURN;
 }
 
 static DWORD WINAPI
 do_populate (LPVOID)
 {
   TSTART;
 
   log_debug ("%s:%s: Populating keycache",
              SRCNAME, __func__);
   do_populate_protocol (GpgME::OpenPGP, false);
   do_populate_protocol (GpgME::OpenPGP, true);
   if (opt.enable_smime)
     {
       do_populate_protocol (GpgME::CMS, false);
       do_populate_protocol (GpgME::CMS, true);
     }
   log_debug ("%s:%s: Keycache populated",
              SRCNAME, __func__);
 
   TRETURN 0;
 }
 
 
 class KeyCache::Private
 {
 public:
   Private()
   {
 
   }
 
   void setPgpKey(const std::string &mbox, const GpgME::Key &key)
   {
     TSTART;
     gpgol_lock (&keycache_lock);
     auto it = m_pgp_key_map.find (mbox);
 
     if (it == m_pgp_key_map.end ())
       {
         m_pgp_key_map.insert (std::pair<std::string, GpgME::Key> (mbox, key));
       }
     else
       {
         it->second = key;
       }
     insertOrUpdateInFprMap (key);
     gpgol_unlock (&keycache_lock);
     TRETURN;
   }
 
   void setSmimeKey(const std::string &mbox, const GpgME::Key &key)
   {
     TSTART;
     gpgol_lock (&keycache_lock);
     auto it = m_smime_key_map.find (mbox);
 
     if (it == m_smime_key_map.end ())
       {
         m_smime_key_map.insert (std::pair<std::string, GpgME::Key> (mbox, key));
       }
     else
       {
         it->second = key;
       }
     insertOrUpdateInFprMap (key);
     gpgol_unlock (&keycache_lock);
     TRETURN;
   }
 
   void setPgpKeySecret(const std::string &mbox, const GpgME::Key &key,
                        bool insert = true)
   {
     TSTART;
     gpgol_lock (&keycache_lock);
     auto it = m_pgp_skey_map.find (mbox);
 
     if (it == m_pgp_skey_map.end ())
       {
         m_pgp_skey_map.insert (std::pair<std::string, GpgME::Key> (mbox, key));
       }
     else
       {
         it->second = key;
       }
     if (insert)
       {
         insertOrUpdateInFprMap (key);
       }
     gpgol_unlock (&keycache_lock);
     TRETURN;
   }
 
   void setSmimeKeySecret(const std::string &mbox, const GpgME::Key &key,
                          bool insert = true)
   {
     TSTART;
     gpgol_lock (&keycache_lock);
     auto it = m_smime_skey_map.find (mbox);
 
     if (it == m_smime_skey_map.end ())
       {
         m_smime_skey_map.insert (std::pair<std::string, GpgME::Key> (mbox, key));
       }
     else
       {
         it->second = key;
       }
     if (insert)
       {
         insertOrUpdateInFprMap (key);
       }
     gpgol_unlock (&keycache_lock);
     TRETURN;
   }
 
   std::vector<GpgME::Key> getPGPOverrides (const char *addr)
   {
     TSTART;
     std::vector<GpgME::Key> ret;
 
     if (!addr)
       {
         TRETURN ret;
       }
     auto mbox = GpgME::UserID::addrSpecFromString (addr);
 
     gpgol_lock (&keycache_lock);
     const auto it = m_addr_book_overrides.find (mbox);
     if (it == m_addr_book_overrides.end ())
       {
         gpgol_unlock (&keycache_lock);
         TRETURN ret;
       }
     for (const auto fpr: it->second)
       {
         const auto key = getByFpr (fpr.c_str (), false);
         if (key.isNull())
           {
             log_debug ("%s:%s: No key for %s in the cache?!",
                        SRCNAME, __func__, anonstr (fpr.c_str()));
             continue;
           }
         ret.push_back (key);
       }
 
     gpgol_unlock (&keycache_lock);
     TRETURN ret;
   }
 
   GpgME::Key getKey (const char *addr, GpgME::Protocol proto)
   {
     TSTART;
     if (!addr)
       {
         TRETURN GpgME::Key();
       }
     auto mbox = GpgME::UserID::addrSpecFromString (addr);
 
     if (proto == GpgME::OpenPGP)
       {
         gpgol_lock (&keycache_lock);
         const auto it = m_pgp_key_map.find (mbox);
 
         if (it == m_pgp_key_map.end ())
           {
             gpgol_unlock (&keycache_lock);
             TRETURN GpgME::Key();
           }
         const auto ret = it->second;
         gpgol_unlock (&keycache_lock);
 
         TRETURN ret;
       }
     gpgol_lock (&keycache_lock);
     const auto it = m_smime_key_map.find (mbox);
 
     if (it == m_smime_key_map.end ())
       {
         gpgol_unlock (&keycache_lock);
         TRETURN GpgME::Key();
       }
     const auto ret = it->second;
     gpgol_unlock (&keycache_lock);
 
     TRETURN ret;
   }
 
   GpgME::Key getSKey (const char *addr, GpgME::Protocol proto)
   {
     TSTART;
     if (!addr)
       {
         TRETURN GpgME::Key();
       }
     auto mbox = GpgME::UserID::addrSpecFromString (addr);
 
     if (proto == GpgME::OpenPGP)
       {
         gpgol_lock (&keycache_lock);
         const auto it = m_pgp_skey_map.find (mbox);
 
         if (it == m_pgp_skey_map.end ())
           {
             gpgol_unlock (&keycache_lock);
             TRETURN GpgME::Key();
           }
         const auto ret = it->second;
         gpgol_unlock (&keycache_lock);
 
         TRETURN ret;
       }
     gpgol_lock (&keycache_lock);
     const auto it = m_smime_skey_map.find (mbox);
 
     if (it == m_smime_skey_map.end ())
       {
         gpgol_unlock (&keycache_lock);
         TRETURN GpgME::Key();
       }
     const auto ret = it->second;
     gpgol_unlock (&keycache_lock);
 
     TRETURN ret;
   }
 
   GpgME::Key getSigningKey (const char *addr, GpgME::Protocol proto)
   {
     TSTART;
     const auto key = getSKey (addr, proto);
     if (key.isNull())
       {
         log_debug ("%s:%s: secret key for %s is null",
                    SRCNAME, __func__, anonstr (addr));
         TRETURN key;
       }
     if (!key.canReallySign())
       {
         log_debug ("%s:%s: Discarding key for %s because it can't sign",
                    SRCNAME, __func__, anonstr (addr));
         TRETURN GpgME::Key();
       }
     if (!key.hasSecret())
       {
         log_debug ("%s:%s: Discarding key for %s because it has no secret",
                    SRCNAME, __func__, anonstr (addr));
         TRETURN GpgME::Key();
       }
     if (in_de_vs_mode () && !key.isDeVs())
       {
         log_debug ("%s:%s: signing key for %s is not deVS",
                    SRCNAME, __func__, anonstr (addr));
         TRETURN GpgME::Key();
       }
     TRETURN key;
   }
 
   std::vector<GpgME::Key> getEncryptionKeys (const std::vector<std::string>
                                              &recipients,
                                              GpgME::Protocol proto)
   {
     TSTART;
     std::vector<GpgME::Key> ret;
     if (recipients.empty ())
       {
         TRACEPOINT;
         TRETURN ret;
       }
     for (const auto &recip: recipients)
       {
         if (proto == GpgME::OpenPGP)
           {
             const auto overrides = getPGPOverrides (recip.c_str ());
 
             if (!overrides.empty())
               {
                 ret.insert (ret.end (), overrides.begin (), overrides.end ());
                 log_debug ("%s:%s: Using overides for %s",
                            SRCNAME, __func__, anonstr (recip.c_str ()));
                 continue;
               }
           }
         const auto key = getKey (recip.c_str (), proto);
         if (key.isNull())
           {
             log_debug ("%s:%s: No key for %s. no internal encryption",
                        SRCNAME, __func__, anonstr (recip.c_str ()));
             TRETURN std::vector<GpgME::Key>();
           }
 
         if (!key.canEncrypt() || key.isRevoked() ||
             key.isExpired() || key.isDisabled() || key.isInvalid())
           {
             log_data ("%s:%s: Invalid key for %s. no internal encryption",
                        SRCNAME, __func__, anonstr (recip.c_str ()));
             TRETURN std::vector<GpgME::Key>();
           }
 
         if (in_de_vs_mode () && !key.isDeVs ())
           {
             log_data ("%s:%s: key for %s is not deVS",
                       SRCNAME, __func__, anonstr (recip.c_str ()));
             TRETURN std::vector<GpgME::Key>();
           }
 
         bool validEnough = false;
         /* Here we do the check if the key is valid for this recipient */
         const auto addrSpec = GpgME::UserID::addrSpecFromString (recip.c_str ());
         for (const auto &uid: key.userIDs ())
           {
             if (addrSpec != uid.addrSpec())
               {
                 // Ignore unmatching addr specs
                 continue;
               }
             if (uid.validity() >= GpgME::UserID::Marginal ||
                 uid.origin() == GpgME::Key::OriginWKD)
               {
                 validEnough = true;
                 break;
               }
             if (opt.auto_unstrusted &&
                 uid.validity() == GpgME::UserID::Unknown)
               {
                 log_debug ("%s:%s: Passing unknown trust key for %s because of option",
                            SRCNAME, __func__, anonstr (recip.c_str ()));
                 validEnough = true;
                 break;
               }
           }
         if (!validEnough)
           {
             log_debug ("%s:%s: UID for %s does not have at least marginal trust",
                        SRCNAME, __func__, anonstr (recip.c_str ()));
             TRETURN std::vector<GpgME::Key>();
           }
         // Accepting key
         ret.push_back (key);
       }
     TRETURN ret;
   }
 
   void insertOrUpdateInFprMap (const GpgME::Key &key)
     {
       TSTART;
       if (key.isNull() || !key.primaryFingerprint())
         {
           TRACEPOINT;
           TRETURN;
         }
       gpgol_lock (&fpr_map_lock);
 
       /* First ensure that we have the subkeys mapped to the primary
          fpr */
       const char *primaryFpr = key.primaryFingerprint ();
 
       for (const auto &sub: key.subkeys())
         {
           const char *subFpr = sub.fingerprint();
           auto it = m_sub_fpr_map.find (subFpr);
           if (it == m_sub_fpr_map.end ())
             {
               m_sub_fpr_map.insert (std::make_pair(
                                      std::string (subFpr),
                                      std::string (primaryFpr)));
             }
         }
 
       auto it = m_fpr_map.find (primaryFpr);
 
       if (it == m_fpr_map.end ())
         {
           m_fpr_map.insert (std::make_pair (primaryFpr, key));
 
           gpgol_unlock (&fpr_map_lock);
           TRETURN;
         }
 
       for (const auto &uid: key.userIDs())
         {
           if (key.isBad() || uid.isBad())
             {
               continue;
             }
           /* Update ultimate keys map */
           if (uid.validity() == GpgME::UserID::Validity::Ultimate &&
               uid.id())
             {
               const char *fpr = key.primaryFingerprint();
               if (!fpr)
                 {
                   STRANGEPOINT;
                   continue;
                 }
               TRACEPOINT;
               m_ultimate_keys.erase (std::remove_if (m_ultimate_keys.begin(),
                                      m_ultimate_keys.end(),
                                      [fpr] (const GpgME::Key &ult)
                 {
                   return ult.primaryFingerprint() && !strcmp (fpr, ult.primaryFingerprint());
                 }), m_ultimate_keys.end());
               TRACEPOINT;
               m_ultimate_keys.push_back (key);
             }
 
           /* Update skey maps */
           if (key.hasSecret ())
             {
               if (key.protocol () == GpgME::OpenPGP)
                 {
                   setPgpKeySecret (uid.addrSpec(), key, false);
                 }
               else if (key.protocol () == GpgME::CMS)
                 {
                   setSmimeKeySecret (uid.addrSpec(), key, false);
                 }
               else
                 {
                   STRANGEPOINT;
                 }
             }
         }
 
       if (it->second.hasSecret () && !key.hasSecret())
         {
           log_debug ("%s:%s Lost secret info on update. Merging.",
                      SRCNAME, __func__);
           auto merged = key;
           merged.mergeWith (it->second);
           it->second = merged;
         }
       else
         {
           it->second = key;
         }
       gpgol_unlock (&fpr_map_lock);
       TRETURN;
     }
 
   GpgME::Key getFromMap (const char *fpr) const
   {
     TSTART;
     if (!fpr)
       {
         TRACEPOINT;
         TRETURN GpgME::Key();
       }
 
     gpgol_lock (&fpr_map_lock);
     std::string primaryFpr;
     const auto it = m_sub_fpr_map.find (fpr);
     if (it != m_sub_fpr_map.end ())
       {
         log_debug ("%s:%s using \"%s\" for \"%s\"",
                    SRCNAME, __func__, anonstr (it->second.c_str()),
                    anonstr (fpr));
         primaryFpr = it->second;
       }
     else
       {
         primaryFpr = fpr;
       }
 
     const auto keyIt = m_fpr_map.find (primaryFpr);
     if (keyIt != m_fpr_map.end ())
       {
         const auto ret = keyIt->second;
         gpgol_unlock (&fpr_map_lock);
         TRETURN ret;
       }
     gpgol_unlock (&fpr_map_lock);
     TRETURN GpgME::Key();
   }
 
   GpgME::Key getByFpr (const char *fpr, bool block) const
     {
       TSTART;
       if (!fpr)
         {
           TRACEPOINT;
           TRETURN GpgME::Key ();
         }
 
       TRACEPOINT;
       const auto ret = getFromMap (fpr);
       if (ret.isNull())
         {
           // If the key was not found we need to check if there is
           // an update running.
           if (block)
             {
               const std::string sFpr (fpr);
               int i = 0;
 
               gpgol_lock (&update_lock);
               while (m_update_jobs.find(sFpr) != m_update_jobs.end ())
                 {
                   i++;
                   if (i % 100 == 0)
                     {
                       log_debug ("%s:%s Waiting on update for \"%s\"",
                                  SRCNAME, __func__, anonstr (fpr));
                     }
                   gpgol_unlock (&update_lock);
                   Sleep (10);
                   gpgol_lock (&update_lock);
                   if (i == 3000)
                     {
                       /* Just to be on the save side */
                       log_error ("%s:%s Waiting on update for \"%s\" "
                                  "failed! Bug!",
                                  SRCNAME, __func__, anonstr (fpr));
                       break;
                     }
                 }
               gpgol_unlock (&update_lock);
 
               TRACEPOINT;
               const auto ret2 = getFromMap (fpr);
               if (ret2.isNull ())
                 {
                   log_debug ("%s:%s Cache miss after blocking check %s.",
                              SRCNAME, __func__, anonstr (fpr));
                 }
               else
                 {
                   log_debug ("%s:%s Cache hit after wait for %s.",
                              SRCNAME, __func__, anonstr (fpr));
                   TRETURN ret2;
                 }
             }
           log_debug ("%s:%s Cache miss for %s.",
                      SRCNAME, __func__, anonstr (fpr));
           TRETURN GpgME::Key();
         }
 
       log_debug ("%s:%s Cache hit for %s.",
                  SRCNAME, __func__, anonstr (fpr));
       TRETURN ret;
     }
 
   void update (const char *fpr, GpgME::Protocol proto)
      {
        TSTART;
        if (!fpr)
          {
            TRETURN;
          }
        const std::string sFpr (fpr);
        gpgol_lock (&update_lock);
        if (m_update_jobs.find(sFpr) != m_update_jobs.end ())
          {
            log_debug ("%s:%s Update for \"%s\" already in progress.",
                       SRCNAME, __func__, anonstr (fpr));
            gpgol_unlock (&update_lock);
          }
 
        m_update_jobs.insert (sFpr);
        gpgol_unlock (&update_lock);
        update_arg_t * args = new update_arg_t;
        args->first = sFpr;
        args->second = proto;
        CloseHandle (CreateThread (NULL, 0, do_update,
                                   (LPVOID) args, 0,
                                   NULL));
        TRETURN;
      }
 
   void onUpdateJobDone (const char *fpr, const GpgME::Key &key)
     {
       TSTART;
       if (!fpr)
         {
           TRETURN;
         }
       TRACEPOINT;
       insertOrUpdateInFprMap (key);
       gpgol_lock (&update_lock);
       const auto it = m_update_jobs.find(fpr);
 
       if (it == m_update_jobs.end())
         {
           gpgol_unlock (&update_lock);
           TRETURN;
         }
       m_update_jobs.erase (it);
       gpgol_unlock (&update_lock);
       TRACEPOINT;
       TRETURN;
     }
 
   void importFromAddrBook (const std::string &mbox, const char *data,
                            Mail *mail)
     {
       TSTART;
       if (!data || mbox.empty() || !mail)
         {
           TRACEPOINT;
           TRETURN;
         }
 
       std::string sdata (data);
       trim (sdata);
       if (sdata.empty())
         {
           TRETURN;
         }
       gpgol_lock (&import_lock);
       if (m_import_jobs.find (mbox) != m_import_jobs.end ())
         {
           log_debug ("%s:%s import for \"%s\" already in progress.",
                      SRCNAME, __func__, anonstr (mbox.c_str ()));
           gpgol_unlock (&import_lock);
         }
       m_import_jobs.insert (mbox);
       gpgol_unlock (&import_lock);
 
       import_arg_t * args = new import_arg_t;
       args->first = std::unique_ptr<LocateArgs> (new LocateArgs (mbox, mail));
       args->second = sdata;
       CloseHandle (CreateThread (NULL, 0, do_import,
                                  (LPVOID) args, 0,
                                  NULL));
 
       TRETURN;
     }
 
   void onAddrBookImportJobDone (const std::string &mbox,
                                 const std::vector<std::string> &result_fprs)
     {
       TSTART;
       gpgol_lock (&keycache_lock);
       auto it = m_addr_book_overrides.find (mbox);
       if (it != m_addr_book_overrides.end ())
         {
           it->second = result_fprs;
         }
       else
         {
           m_addr_book_overrides.insert (
                 std::make_pair (mbox, result_fprs));
         }
       gpgol_unlock (&keycache_lock);
       gpgol_lock (&import_lock);
       const auto job_it = m_import_jobs.find(mbox);
 
       if (job_it == m_import_jobs.end())
         {
           log_error ("%s:%s import for \"%s\" already finished.",
                      SRCNAME, __func__, anonstr (mbox.c_str ()));
           gpgol_unlock (&import_lock);
           TRETURN;
         }
       m_import_jobs.erase (job_it);
       gpgol_unlock (&import_lock);
       TRETURN;
     }
 
   void populate ()
     {
       TSTART;
       gpgrt_lock_lock (&keycache_lock);
       m_ultimate_keys.clear ();
       gpgrt_lock_unlock (&keycache_lock);
       CloseHandle (CreateThread (nullptr, 0, do_populate,
                                  nullptr, 0,
                                  nullptr));
       TRETURN;
     }
 
   std::unordered_map<std::string, GpgME::Key> m_pgp_key_map;
   std::unordered_map<std::string, GpgME::Key> m_smime_key_map;
   std::unordered_map<std::string, GpgME::Key> m_pgp_skey_map;
   std::unordered_map<std::string, GpgME::Key> m_smime_skey_map;
   std::unordered_map<std::string, GpgME::Key> m_fpr_map;
   std::unordered_map<std::string, std::string> m_sub_fpr_map;
   std::unordered_map<std::string, std::vector<std::string> >
     m_addr_book_overrides;
   std::vector<GpgME::Key> m_ultimate_keys;
   std::set<std::string> m_update_jobs;
   std::set<std::string> m_import_jobs;
 };
 
 KeyCache::KeyCache():
   d(new Private)
 {
 }
 
 KeyCache *
 KeyCache::instance ()
 {
   if (!singleton)
     {
       singleton = new KeyCache();
     }
   return singleton;
 }
 
 GpgME::Key
 KeyCache::getSigningKey (const char *addr, GpgME::Protocol proto) const
 {
   return d->getSigningKey (addr, proto);
 }
 
 std::vector<GpgME::Key>
 KeyCache::getEncryptionKeys (const std::vector<std::string> &recipients, GpgME::Protocol proto) const
 {
   return d->getEncryptionKeys (recipients, proto);
 }
 
 static GpgME::Key
 get_most_valid_key_simple (const std::vector<GpgME::Key> &keys)
 {
   GpgME::Key candidate;
   for (const auto &key: keys)
     {
       if (key.isRevoked() || key.isExpired() ||
           key.isDisabled() || key.isInvalid())
         {
           log_debug ("%s:%s: Skipping invalid S/MIME key",
                      SRCNAME, __func__);
           continue;
         }
       if (candidate.isNull() || !candidate.numUserIDs())
         {
           if (key.numUserIDs() &&
               candidate.userID(0).validity() <= key.userID(0).validity())
             {
               candidate = key;
             }
         }
     }
   return candidate;
 }
 
 static std::vector<GpgME::Key>
 get_local_smime_keys (const std::string &addr)
 {
   TSTART;
   std::vector<GpgME::Key> keys;
   auto ctx = std::unique_ptr<GpgME::Context> (
                                               GpgME::Context::createForProtocol (GpgME::CMS));
   if (!ctx)
     {
       TRACEPOINT;
       TRETURN keys;
     }
   // We need to validate here to fetch CRL's
   ctx->setKeyListMode (GpgME::KeyListMode::Local |
                        GpgME::KeyListMode::Validate |
                        GpgME::KeyListMode::Signatures);
   GpgME::Error e = ctx->startKeyListing (addr.c_str());
   if (e)
     {
       TRACEPOINT;
       TRETURN keys;
     }
 
   GpgME::Error err;
   do {
       keys.push_back(ctx->nextKey(err));
   } while (!err);
   keys.pop_back();
 
   TRETURN keys;
 }
 
 static std::vector<GpgME::Key>
 get_extern_smime_keys (const std::string &addr, bool import)
 {
   TSTART;
   std::vector<GpgME::Key> keys;
   auto ctx = std::unique_ptr<GpgME::Context> (
                                               GpgME::Context::createForProtocol (GpgME::CMS));
   if (!ctx)
     {
       TRACEPOINT;
       TRETURN keys;
     }
   // We need to validate here to fetch CRL's
   ctx->setKeyListMode (GpgME::KeyListMode::Extern);
   GpgME::Error e = ctx->startKeyListing (addr.c_str());
   if (e)
     {
       TRACEPOINT;
       TRETURN keys;
     }
 
   GpgME::Error err;
   do
     {
       const auto key = ctx->nextKey (err);
       if (!err && !key.isNull())
         {
           keys.push_back (key);
           log_debug ("%s:%s: Found extern S/MIME key for %s with fpr: %s",
                      SRCNAME, __func__, anonstr (addr.c_str()),
                      anonstr (key.primaryFingerprint()));
         }
     } while (!err);
 
   if (import && keys.size ())
     {
       const GpgME::ImportResult res = ctx->importKeys(keys);
       log_debug ("%s:%s: Import result for %s: err: %s",
                  SRCNAME, __func__, anonstr (addr.c_str()),
                  res.error ().asString ());
 
     }
 
   TRETURN keys;
 }
 
 static DWORD WINAPI
 do_locate (LPVOID arg)
 {
   TSTART;
   if (!arg)
     {
       TRETURN 0;
     }
 
   auto args = std::unique_ptr<LocateArgs> ((LocateArgs *) arg);
 
   const auto addr = args->m_mbox;
 
   log_debug ("%s:%s searching key for addr: \"%s\"",
              SRCNAME, __func__, anonstr (addr.c_str()));
 
   const auto k = GpgME::Key::locate (addr.c_str());
 
   if (!k.isNull ())
     {
       log_debug ("%s:%s found key for addr: \"%s\":%s",
                  SRCNAME, __func__, anonstr (addr.c_str()),
                  anonstr (k.primaryFingerprint()));
       KeyCache::instance ()->setPgpKey (addr, k);
     }
   log_debug ("%s:%s pgp locate done",
              SRCNAME, __func__);
 
   if (opt.enable_smime)
     {
       GpgME::Key candidate = get_most_valid_key_simple (
                                     get_local_smime_keys (addr));
       if (!candidate.isNull())
         {
           log_debug ("%s:%s found SMIME key for addr: \"%s\":%s",
                      SRCNAME, __func__, anonstr (addr.c_str()),
                      anonstr (candidate.primaryFingerprint()));
           KeyCache::instance()->setSmimeKey (addr, candidate);
           TRETURN 0;
         }
       if (!opt.search_smime_servers || (!k.isNull() && !opt.prefer_smime))
         {
           log_debug ("%s:%s Found no S/MIME key locally and external "
                      "search is disabled.", SRCNAME, __func__);
           TRETURN 0;
         }
       /* Search for extern keys and import them */
       const auto externs = get_extern_smime_keys (addr, true);
       if (externs.empty())
         {
           TRETURN 0;
         }
       /* We found and imported external keys. We need to get them
          locally now to ensure that they are valid etc. */
       candidate = get_most_valid_key_simple (
                                     get_local_smime_keys (addr));
       if (!candidate.isNull())
         {
           log_debug ("%s:%s found ext. SMIME key for addr: \"%s\":%s",
                      SRCNAME, __func__, anonstr (addr.c_str()),
                      anonstr (candidate.primaryFingerprint()));
           KeyCache::instance()->setSmimeKey (addr, candidate);
           TRETURN 0;
         }
       else
         {
           log_debug ("%s:%s: Found no valid key in extern S/MIME certs",
                      SRCNAME, __func__);
         }
     }
   TRETURN 0;
 }
 
 static void
 locate_secret (const char *addr, GpgME::Protocol proto)
 {
   TSTART;
   auto ctx = std::unique_ptr<GpgME::Context> (
                       GpgME::Context::createForProtocol (proto));
   if (!ctx)
     {
       TRACEPOINT;
       TRETURN;
     }
   if (!addr)
     {
       TRACEPOINT;
       TRETURN;
     }
   const auto mbox = GpgME::UserID::addrSpecFromString (addr);
 
   if (mbox.empty())
     {
       log_debug ("%s:%s: Empty mbox for addr %s",
                  SRCNAME, __func__, anonstr (addr));
       TRETURN;
     }
 
   // We need to validate here to fetch CRL's
   ctx->setKeyListMode (GpgME::KeyListMode::Local |
                        GpgME::KeyListMode::Validate);
   GpgME::Error e = ctx->startKeyListing (mbox.c_str(), true);
   if (e)
     {
       TRACEPOINT;
       TRETURN;
     }
 
   std::vector<GpgME::Key> keys;
   GpgME::Error err;
   do
     {
       const auto key = ctx->nextKey(err);
       if (key.isNull())
         {
           continue;
         }
       if (key.isRevoked() || key.isExpired() ||
           key.isDisabled() || key.isInvalid())
         {
           if ((opt.enable_debug & DBG_DATA))
             {
               std::stringstream ss;
               ss << key;
               log_data ("%s:%s: Skipping invalid secret key %s",
                         SRCNAME, __func__, ss.str().c_str());
             }
           continue;
         }
       if (proto == GpgME::OpenPGP)
         {
           log_debug ("%s:%s found pgp skey for addr: \"%s\":%s",
                      SRCNAME, __func__, anonstr (mbox.c_str()),
                      anonstr (key.primaryFingerprint()));
           KeyCache::instance()->setPgpKeySecret (mbox, key);
           TRETURN;
         }
       if (proto == GpgME::CMS)
         {
           log_debug ("%s:%s found cms skey for addr: \"%s\":%s",
                      SRCNAME, __func__, anonstr (mbox.c_str ()),
                      anonstr (key.primaryFingerprint()));
           KeyCache::instance()->setSmimeKeySecret (mbox, key);
           TRETURN;
         }
     } while (!err);
   TRETURN;
 }
 
 static DWORD WINAPI
 do_locate_secret (LPVOID arg)
 {
   TSTART;
   auto args = std::unique_ptr<LocateArgs> ((LocateArgs *) arg);
 
   log_debug ("%s:%s searching secret key for addr: \"%s\"",
              SRCNAME, __func__, anonstr (args->m_mbox.c_str ()));
 
   locate_secret (args->m_mbox.c_str(), GpgME::OpenPGP);
   if (opt.enable_smime)
     {
       locate_secret (args->m_mbox.c_str(), GpgME::CMS);
     }
   log_debug ("%s:%s locator sthread thread done",
              SRCNAME, __func__);
   TRETURN 0;
 }
 
 void
 KeyCache::startLocate (const std::vector<std::string> &addrs, Mail *mail) const
 {
   for (const auto &addr: addrs)
     {
       startLocate (addr.c_str(), mail);
     }
 }
 
 void
 KeyCache::startLocate (const char *addr, Mail *mail) const
 {
   TSTART;
   if (!addr)
     {
       TRACEPOINT;
       TRETURN;
     }
   std::string recp = GpgME::UserID::addrSpecFromString (addr);
   if (recp.empty ())
     {
       TRETURN;
     }
   gpgol_lock (&keycache_lock);
   if (d->m_pgp_key_map.find (recp) == d->m_pgp_key_map.end ())
     {
       // It's enough to look at the PGP Key map. We marked
       // searched keys there.
       d->m_pgp_key_map.insert (std::pair<std::string, GpgME::Key> (recp, GpgME::Key()));
       log_debug ("%s:%s Creating a locator thread",
                  SRCNAME, __func__);
       const auto args = new LocateArgs(recp, mail);
       HANDLE thread = CreateThread (NULL, 0, do_locate,
                                     args, 0,
                                     NULL);
       CloseHandle (thread);
     }
   gpgol_unlock (&keycache_lock);
   TRETURN;
 }
 
 void
 KeyCache::startLocateSecret (const char *addr, Mail *mail) const
 {
   TSTART;
   if (!addr)
     {
       TRACEPOINT;
       TRETURN;
     }
   std::string recp = GpgME::UserID::addrSpecFromString (addr);
   if (recp.empty ())
     {
       TRETURN;
     }
   gpgol_lock (&keycache_lock);
   if (d->m_pgp_skey_map.find (recp) == d->m_pgp_skey_map.end ())
     {
       // It's enough to look at the PGP Key map. We marked
       // searched keys there.
       d->m_pgp_skey_map.insert (std::pair<std::string, GpgME::Key> (recp, GpgME::Key()));
       log_debug ("%s:%s Creating a locator thread",
                  SRCNAME, __func__);
       const auto args = new LocateArgs(recp, mail);
 
       HANDLE thread = CreateThread (NULL, 0, do_locate_secret,
                                     (LPVOID) args, 0,
                                     NULL);
       CloseHandle (thread);
     }
   gpgol_unlock (&keycache_lock);
   TRETURN;
 }
 
 
 void
 KeyCache::setSmimeKey(const std::string &mbox, const GpgME::Key &key)
 {
   d->setSmimeKey(mbox, key);
 }
 
 void
 KeyCache::setPgpKey(const std::string &mbox, const GpgME::Key &key)
 {
   d->setPgpKey(mbox, key);
 }
 
 void
 KeyCache::setSmimeKeySecret(const std::string &mbox, const GpgME::Key &key)
 {
   d->setSmimeKeySecret(mbox, key);
 }
 
 void
 KeyCache::setPgpKeySecret(const std::string &mbox, const GpgME::Key &key)
 {
   d->setPgpKeySecret(mbox, key);
 }
 
 bool
 KeyCache::isMailResolvable(Mail *mail)
 {
   TSTART;
   /* Get the data from the mail. */
   const auto sender = mail->getSender ();
   auto recps = mail->getCachedRecipients ();
 
   if (sender.empty() || recps.empty())
     {
       log_debug ("%s:%s: Mail has no sender or no recipients.",
                  SRCNAME, __func__);
       TRETURN false;
     }
 
 
   std::vector<GpgME::Key> encKeys = getEncryptionKeys (recps,
                                                        GpgME::OpenPGP);
 
   if (!encKeys.empty())
     {
       TRETURN true;
     }
 
   if (!opt.enable_smime)
     {
       TRETURN false;
     }
 
   /* Check S/MIME instead here we need to include the sender
      as we can't just generate a key. */
   recps.push_back (sender);
   GpgME::Key sigKey= getSigningKey (sender.c_str(), GpgME::CMS);
   encKeys = getEncryptionKeys (recps, GpgME::CMS);
 
   TRETURN !encKeys.empty() && !sigKey.isNull();
 }
 
 void
 KeyCache::update (const char *fpr, GpgME::Protocol proto)
 {
   d->update (fpr, proto);
 }
 
 GpgME::Key
 KeyCache::getByFpr (const char *fpr, bool block) const
 {
   return d->getByFpr (fpr, block);
 }
 
 void
 KeyCache::onUpdateJobDone (const char *fpr, const GpgME::Key &key)
 {
   return d->onUpdateJobDone (fpr, key);
 }
 
 void
 KeyCache::importFromAddrBook (const std::string &mbox, const char *key_data,
                               Mail *mail) const
 {
   return d->importFromAddrBook (mbox, key_data, mail);
 }
 
 void
 KeyCache::onAddrBookImportJobDone (const std::string &mbox,
                                    const std::vector<std::string> &result_fprs)
 {
   return d->onAddrBookImportJobDone (mbox, result_fprs);
 }
 
 std::vector<GpgME::Key>
 KeyCache::getOverrides (const std::string &mbox)
 {
   return d->getPGPOverrides (mbox.c_str ());
 }
 
 void
 KeyCache::populate ()
 {
   return d->populate ();
 }
 
 std::vector<GpgME::Key>
 KeyCache::getUltimateKeys ()
 {
   gpgrt_lock_lock (&fpr_map_lock);
   const auto ret = d->m_ultimate_keys;
   gpgrt_lock_unlock (&fpr_map_lock);
   return ret;
 }
+
+/* static */
+bool
+KeyCache::import_pgp_key_data (const GpgME::Data &data)
+{
+  TSTART;
+  if (data.isNull())
+    {
+      STRANGEPOINT;
+      TRETURN false;
+    }
+  auto ctx = GpgME::Context::create(GpgME::OpenPGP);
+
+  if (!ctx)
+    {
+      STRANGEPOINT;
+      TRETURN false;
+    }
+
+  const auto type = data.type();
+
+  if (type != GpgME::Data::PGPKey)
+    {
+      log_debug ("%s:%s: Data does not look like PGP Keys",
+                 SRCNAME, __func__);
+      TRETURN false;
+    }
+  const auto keys = data.toKeys();
+
+  if (keys.empty())
+    {
+      log_debug ("%s:%s: Data does not contain PGP Keys",
+                 SRCNAME, __func__);
+      TRETURN false;
+    }
+
+  if (opt.enable_debug & DBG_DATA)
+    {
+      std::stringstream ss;
+      for (const auto &key: keys)
+        {
+          ss << key << '\n';
+        }
+      log_debug ("Importing keys: %s", ss.str().c_str());
+    }
+  const auto result = ctx->importKeys(keys);
+
+  log_debug ("%s:%s: Import result from attached key err: %s",
+             SRCNAME, __func__, result.error ().asString ());
+  TRETURN !result.error();
+}
diff --git a/src/keycache.h b/src/keycache.h
index 0a90575..0563e24 100644
--- a/src/keycache.h
+++ b/src/keycache.h
@@ -1,148 +1,153 @@
 #ifndef KEYCACHE_H
 #define KEYCACHE_H
 
 /* @file keycache.h
  * @brief Internal keycache
  *
  * Copyright (C) 2018 Intevation GmbH
  *
  * This file is part of GpgOL.
  *
  * GpgOL is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
  * GpgOL is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  * GNU Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include "config.h"
 
 #include <memory>
 #include <vector>
 
 #include <gpgme++/global.h>
 
 namespace GpgME
 {
   class Key;
+  class Data;
 };
 
 class Mail;
 
 class KeyCache
 {
 protected:
     /** Internal ctor */
     explicit KeyCache ();
 
 public:
     /** Get the KeyCache */
     static KeyCache* instance ();
 
     /* Try to find a key for signing in the internal secret key
        cache. If no proper key is found a Null key is
        returned.*/
     GpgME::Key getSigningKey (const char *addr, GpgME::Protocol proto) const;
 
     /* Get the keys for recipents. The keys
        are taken from the internal cache. If
        one recipient can't be resolved an empty
        list is returned.
        */
     std::vector<GpgME::Key> getEncryptionKeys (const std::vector<std::string> &recipients,
                                                GpgME::Protocol proto) const;
 
     /* Start a key location in a background thread filling
        the key cache.
 
        The mail argument is used to add / remove the
        locator thread counter.
 
        async
        */
     void startLocate (const std::vector<std::string> &addrs, Mail *mail) const;
 
     /* Look for a secret key for the addr.
 
        async
     */
     void startLocateSecret (const char *addr, Mail *mail) const;
 
     /* Start a key location in a background thread filling
        the key cache.
 
        async
        */
     void startLocate (const char *addr, Mail *mail) const;
 
     /* Check that a mail is resolvable through the keycache.
      *
      * For OpenPGP only the recipients are checked as we can
      * generate a new key for the sender.
      **/
     bool isMailResolvable (Mail *mail);
 
     /* Search / Update a key in the cache. This is meant to be
        called e.g. after a verify to update the key.
 
        async
 
        A known issue is that a get right after it might
        still return an outdated key but the get after that
        would return the updated one. This is acceptable as
        it only poses a minor problem with TOFU while we
        can show the correct state in the tooltip. */
     void update (const char *fpr, GpgME::Protocol proto);
 
     /* Get a cached key. If block is true it will block
        if the key is currently searched for.
 
        This function will not search a key. Call update
        to insert keys into the cache */
     GpgME::Key getByFpr (const char *fpr, bool block = true) const;
 
     /* Import key data from the address book for the address mbox.
        Keys imported this way take precedence over other keys for
        this mail address regardless of validity.
 
        The mail argument is used to add / remove the
        locator thread counter.
 
        async
     */
     void importFromAddrBook (const std::string &mbox,
                              const char *key_data,
                              Mail *mail) const;
 
     /* Get optional overrides for an address. */
     std::vector<GpgME::Key> getOverrides (const std::string &mbox);
 
     /* Populate the fingerprint and secret key maps */
     void populate ();
 
     /* Get a vector of ultimately trusted keys. */
     std::vector<GpgME::Key> getUltimateKeys ();
 
+    /* Import PGP Keys from a Data object. Returns
+       true on success. */
+    static bool import_pgp_key_data(const GpgME::Data &data);
+
     // Internal for thread
     void setSmimeKey(const std::string &mbox, const GpgME::Key &key);
     void setPgpKey(const std::string &mbox, const GpgME::Key &key);
     void setSmimeKeySecret(const std::string &mbox, const GpgME::Key &key);
     void setPgpKeySecret(const std::string &mbox, const GpgME::Key &key);
     void onUpdateJobDone(const char *fpr, const GpgME::Key &key);
     void onAddrBookImportJobDone (const std::string &fpr,
                                   const std::vector<std::string> &result_fprs);
 
 private:
 
     class Private;
     std::shared_ptr<Private> d;
 };
 
 #endif
diff --git a/src/parsecontroller.cpp b/src/parsecontroller.cpp
index 4a72a65..309e587 100644
--- a/src/parsecontroller.cpp
+++ b/src/parsecontroller.cpp
@@ -1,657 +1,671 @@
 /* @file parsecontroller.cpp
  * @brief Parse a mail and decrypt / verify accordingly
  *
  * Copyright (C) 2016 by Bundesamt für Sicherheit in der Informationstechnik
  * Software engineering by Intevation GmbH
  *
  * This file is part of GpgOL.
  *
  * GpgOL is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
  * GpgOL is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  * GNU Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 #include "config.h"
 
 #include "parsecontroller.h"
 #include "attachment.h"
 #include "mimedataprovider.h"
 
 #include "keycache.h"
 
 #include <gpgme++/context.h>
 #include <gpgme++/decryptionresult.h>
 #include <gpgme++/key.h>
 
 #include <sstream>
 
 #ifdef HAVE_W32_SYSTEM
 #include "common.h"
 /* We use UTF-8 internally. */
 #undef _
 # define _(a) utf8_gettext (a)
 #else
 # define _(a) a
 #endif
 
 
 const char decrypt_template_html[] = {
 "<html><head></head><body>"
 "<table border=\"0\" width=\"100%%\" cellspacing=\"1\" cellpadding=\"1\" bgcolor=\"#0069cc\">"
 "<tr>"
 "<td bgcolor=\"#0080ff\">"
 "<p><span style=\"font-weight:600; background-color:#0080ff;\"><center>%s %s</center><span></p></td></tr>"
 "<tr>"
 "<td bgcolor=\"#e0f0ff\">"
 "<center>"
 "<br/>%s"
 "</td></tr>"
 "</table></body></html>"};
 
 const char decrypt_template[] = {"%s %s\n\n%s"};
 
 using namespace GpgME;
 
 static bool
 expect_no_headers (msgtype_t type)
 {
   TSTART;
   TRETURN type != MSGTYPE_GPGOL_MULTIPART_SIGNED;
 }
 
 static bool
 expect_no_mime (msgtype_t type)
 {
   TSTART;
   TRETURN type == MSGTYPE_GPGOL_PGP_MESSAGE ||
          type == MSGTYPE_GPGOL_CLEAR_SIGNED;
 }
 
 #ifdef BUILD_TESTS
 static void
 get_and_print_key_test (const char *fingerprint, GpgME::Protocol proto)
 {
   if (!fingerprint)
     {
       STRANGEPOINT;
       return;
     }
   auto ctx = std::unique_ptr<GpgME::Context> (GpgME::Context::createForProtocol
                                               (proto));
 
   if (!ctx)
     {
       STRANGEPOINT;
       return;
     }
   ctx->setKeyListMode (GpgME::KeyListMode::Local |
                        GpgME::KeyListMode::Signatures |
                        GpgME::KeyListMode::Validate |
                        GpgME::KeyListMode::WithTofu);
 
   GpgME::Error err;
   const auto newKey = ctx->key (fingerprint, err, false);
 
   std::stringstream ss;
   ss << newKey;
 
   log_debug ("Key: %s", ss.str().c_str());
   return;
 }
 #endif
 
 #ifdef HAVE_W32_SYSTEM
 ParseController::ParseController(LPSTREAM instream, msgtype_t type):
     m_inputprovider  (new MimeDataProvider(instream,
                           expect_no_headers(type))),
     m_outputprovider (new MimeDataProvider(expect_no_mime(type))),
     m_type (type),
     m_block_html (false)
 {
   TSTART;
   memdbg_ctor ("ParseController");
   log_data ("%s:%s: Creating parser for stream: %p of type %i"
                    " expect no headers: %i expect no mime: %i",
                    SRCNAME, __func__, instream, type,
                    expect_no_headers (type), expect_no_mime (type));
   TRETURN;
 }
 #endif
 
 ParseController::ParseController(FILE *instream, msgtype_t type):
     m_inputprovider  (new MimeDataProvider(instream,
                           expect_no_headers(type))),
     m_outputprovider (new MimeDataProvider(expect_no_mime(type))),
     m_type (type),
     m_block_html (false)
 {
   TSTART;
   memdbg_ctor ("ParseController");
   log_data ("%s:%s: Creating parser for stream: %p of type %i",
                    SRCNAME, __func__, instream, type);
   TRETURN;
 }
 
 ParseController::~ParseController()
 {
   TSTART;
   log_debug ("%s:%s", SRCNAME, __func__);
   memdbg_dtor ("ParseController");
   delete m_inputprovider;
   delete m_outputprovider;
   TRETURN;
 }
 
 static void
 operation_for_type(msgtype_t type, bool *decrypt,
                    bool *verify)
 {
   *decrypt = false;
   *verify = false;
   switch (type)
     {
       case MSGTYPE_GPGOL_MULTIPART_ENCRYPTED:
       case MSGTYPE_GPGOL_PGP_MESSAGE:
         *decrypt = true;
         break;
       case MSGTYPE_GPGOL_MULTIPART_SIGNED:
       case MSGTYPE_GPGOL_CLEAR_SIGNED:
         *verify = true;
         break;
       case MSGTYPE_GPGOL_OPAQUE_SIGNED:
         *verify = true;
         break;
       case MSGTYPE_GPGOL_OPAQUE_ENCRYPTED:
         *decrypt = true;
         break;
       default:
         log_error ("%s:%s: Unknown data type: %i",
                    SRCNAME, __func__, type);
     }
 }
 
 static bool
 is_smime (Data &data)
 {
   TSTART;
   data.seek (0, SEEK_SET);
   auto id = data.type();
   data.seek (0, SEEK_SET);
   TRETURN id == Data::CMSSigned || id == Data::CMSEncrypted;
 }
 
 static std::string
 format_recipients(GpgME::DecryptionResult result, Protocol protocol)
 {
   TSTART;
   std::string msg;
   for (const auto recipient: result.recipients())
     {
       auto ctx = Context::createForProtocol(protocol);
       Error e;
       if (!ctx) {
           /* Can't happen */
           TRACEPOINT;
           continue;
       }
       const auto key = ctx->key(recipient.keyID(), e, false);
       delete ctx;
       if (!key.isNull() && key.numUserIDs() && !e) {
         msg += std::string("<br/>") + key.userIDs()[0].id() + " (0x" + recipient.keyID() + ")";
         continue;
       }
       msg += std::string("<br/>") + _("Unknown Key:") + " 0x" + recipient.keyID();
     }
   TRETURN msg;
 }
 
 static std::string
 format_error(GpgME::DecryptionResult result, Protocol protocol)
 {
   TSTART;
   char *buf;
   bool no_sec = false;
   std::string msg;
 
   if (result.error ().isCanceled () ||
       result.error ().code () == GPG_ERR_NO_SECKEY)
     {
        msg = _("Decryption canceled or timed out.");
     }
 
   if (result.error ().code () == GPG_ERR_DECRYPT_FAILED ||
       result.error ().code () == GPG_ERR_NO_SECKEY)
     {
       no_sec = true;
       for (const auto &recipient: result.recipients ()) {
         no_sec &= (recipient.status ().code () == GPG_ERR_NO_SECKEY);
       }
     }
 
   if (no_sec)
     {
       msg = _("No secret key found to decrypt the message. "
               "It is encrypted to the following keys:");
       msg += format_recipients (result, protocol);
     }
   else
     {
       msg = _("Could not decrypt the data: ");
 
       if (result.isNull ())
         {
           msg += _("Failed to parse the mail.");
         }
       else if (result.isLegacyCipherNoMDC())
         {
           msg += _("Data is not integrity protected. "
                    "Decrypting it could be a security problem. (no MDC)");
         }
       else
         {
           msg += result.error().asString();
         }
     }
 
   if (gpgrt_asprintf (&buf, opt.prefer_html ? decrypt_template_html :
                       decrypt_template,
                       protocol == OpenPGP ? "OpenPGP" : "S/MIME",
                       _("Encrypted message (decryption not possible)"),
                       msg.c_str()) == -1)
     {
       log_error ("%s:%s:Failed to Format error.",
                  SRCNAME, __func__);
       TRETURN "Failed to Format error.";
     }
   msg = buf;
   memdbg_alloc (buf);
   xfree (buf);
   TRETURN msg;
 }
 
 void
 ParseController::setSender(const std::string &sender)
 {
   TSTART;
   m_sender = sender;
   TRETURN;
 }
 
 static bool
 is_valid_chksum(const GpgME::Signature &sig)
 {
   TSTART;
   const auto sum = sig.summary();
   static unsigned int valid_mask = (unsigned int) (
       GpgME::Signature::Valid |
       GpgME::Signature::Green |
       GpgME::Signature::KeyRevoked |
       GpgME::Signature::KeyExpired |
       GpgME::Signature::SigExpired |
       GpgME::Signature::CrlMissing |
       GpgME::Signature::CrlTooOld |
       GpgME::Signature::TofuConflict );
 
   TRETURN sum & valid_mask;
 }
 
 
 /* Note on stability:
 
    Experiments have shown that we can have a crash if parse
    Returns at time that is not good for the state of Outlook.
 
    This happend in my test instance after a delay of > 1s < 3s
    with a < 1% chance :-/
 
    So if you have really really bad luck this might still crash
    although it usually should be either much quicker or much slower
    (slower e.g. when pinentry is requrired).
 */
 void
 ParseController::parse()
 {
   TSTART;
   // Wrap the input stream in an attachment / GpgME Data
   Protocol protocol;
   bool decrypt, verify;
 
   Data input (m_inputprovider);
 
   auto inputType = input.type ();
 
   if (inputType == Data::Type::PGPSigned)
     {
       verify = true;
       decrypt = false;
     }
   else
     {
       operation_for_type (m_type, &decrypt, &verify);
     }
 
   if ((m_inputprovider->signature() && is_smime (*m_inputprovider->signature())) ||
       is_smime (input))
     {
       protocol = Protocol::CMS;
     }
   else
     {
       protocol = Protocol::OpenPGP;
     }
   auto ctx = std::unique_ptr<Context> (Context::createForProtocol (protocol));
   if (!ctx)
     {
       log_error ("%s:%s:Failed to create context. Installation broken.",
                  SRCNAME, __func__);
       char *buf;
       const char *proto = protocol == OpenPGP ? "OpenPGP" : "S/MIME";
       if (gpgrt_asprintf (&buf, opt.prefer_html ? decrypt_template_html :
                           decrypt_template,
                           proto,
                           _("Encrypted message (decryption not possible)"),
                           _("Failed to find GnuPG please ensure that GnuPG or "
                             "Gpg4win is properly installed.")) == -1)
         {
           log_error ("%s:%s:Failed format error.",
                      SRCNAME, __func__);
           /* Should never happen */
           m_error = std::string("Bad installation");
         }
       memdbg_alloc (buf);
       m_error = buf;
       xfree (buf);
       TRETURN;
     }
 
   /* Maybe a different option for this ? */
   if (opt.autoretrieve)
     {
       ctx->setFlag("auto-key-retrieve", "1");
     }
 
   ctx->setArmor(true);
 
   if (!m_sender.empty())
     {
       ctx->setSender(m_sender.c_str());
     }
 
   Data output (m_outputprovider);
   log_debug ("%s:%s:%p decrypt: %i verify: %i with protocol: %s sender: %s type: %i",
              SRCNAME, __func__, this,
              decrypt, verify,
              protocol == OpenPGP ? "OpenPGP" :
              protocol == CMS ? "CMS" : "Unknown",
              m_sender.empty() ? "none" : anonstr (m_sender.c_str()), inputType);
   if (decrypt)
     {
       input.seek (0, SEEK_SET);
       TRACEPOINT;
       auto combined_result = ctx->decryptAndVerify(input, output);
       log_debug ("%s:%s:%p decrypt / verify done.",
                  SRCNAME, __func__, this);
       m_decrypt_result = combined_result.first;
       m_verify_result = combined_result.second;
 
       if ((!m_decrypt_result.error () &&
           m_verify_result.signatures ().empty() &&
           m_outputprovider->signature ()) ||
           is_smime (output) ||
           output.type() == Data::Type::PGPSigned)
         {
           TRACEPOINT;
           /* There is a signature in the output. So we have
              to verify it now as an extra step. */
           input = Data (m_outputprovider);
           delete m_inputprovider;
           m_inputprovider = m_outputprovider;
           m_outputprovider = new MimeDataProvider();
           output = Data(m_outputprovider);
           verify = true;
           TRACEPOINT;
         }
       else
         {
           verify = false;
         }
       TRACEPOINT;
       if (m_decrypt_result.error () || m_decrypt_result.isNull () ||
           m_decrypt_result.error ().isCanceled ())
         {
           m_error = format_error (m_decrypt_result, protocol);
         }
     }
   if (verify)
     {
       TRACEPOINT;
       GpgME::Data *sig = m_inputprovider->signature();
       input.seek (0, SEEK_SET);
       if (sig)
         {
           sig->seek (0, SEEK_SET);
           TRACEPOINT;
           m_verify_result = ctx->verifyDetachedSignature(*sig, input);
           log_debug ("%s:%s:%p verify done.",
                      SRCNAME, __func__, this);
           /* Copy the input to output to do a mime parsing. */
           char buf[4096];
           input.seek (0, SEEK_SET);
           output.seek (0, SEEK_SET);
           size_t nread;
           while ((nread = input.read (buf, 4096)) > 0)
             {
               output.write (buf, nread);
             }
         }
       else
         {
           TRACEPOINT;
           m_verify_result = ctx->verifyOpaqueSignature(input, output);
           TRACEPOINT;
 
           const auto sigs = m_verify_result.signatures();
           bool allBad = sigs.size();
           for (const auto s :sigs)
             {
               if (!(s.summary() & Signature::Red))
                 {
                   allBad = false;
                   break;
                 }
             }
 #ifdef HAVE_W32_SYSTEM
           if (allBad)
             {
               log_debug ("%s:%s:%p inline verify error trying native to utf8.",
                          SRCNAME, __func__, this);
 
 
               /* The proper solution would be to take the encoding from
                  the mail / headers. Then convert the wchar body to that
                  encoding. Verify, and convert it after verifcation to
                  UTF-8 which the rest of the code expects.
 
                  Or native_body from native ACP to InternetCodepage, then
                  verify and convert the output back to utf8 as the rest
                  expects.
 
                  But as this is clearsigned and we don't really want that.
                  Meh.
                  */
               char *utf8 = native_to_utf8 (input.toString().c_str());
               if (utf8)
                 {
                   // Try again after conversion.
                   ctx = std::unique_ptr<Context> (Context::createForProtocol (protocol));
                   ctx->setArmor (true);
                   if (!m_sender.empty())
                     {
                       ctx->setSender(m_sender.c_str());
                     }
 
                   input = Data (utf8, strlen (utf8));
                   xfree (utf8);
 
                   // Use a fresh output
                   auto provider = new MimeDataProvider (true);
 
                   // Warning: The dtor of the Data object touches
                   // the provider. So we have to delete it after
                   // the assignment.
                   output = Data (provider);
                   delete m_outputprovider;
                   m_outputprovider = provider;
 
                   // Try again
                   m_verify_result = ctx->verifyOpaqueSignature(input, output);
                 }
             }
 #else
 (void)allBad;
 #endif
         }
     }
   log_debug ("%s:%s:%p: decrypt err: %i verify err: %i",
              SRCNAME, __func__, this, m_decrypt_result.error().code(),
              m_verify_result.error().code());
 
   bool has_valid_encrypted_checksum = false;
   /* Ensure that the Keys for the signatures are available
      and if it has a valid encrypted checksum. */
   for (const auto sig: m_verify_result.signatures())
     {
       TRACEPOINT;
       has_valid_encrypted_checksum = is_valid_chksum (sig);
 
 #ifndef BUILD_TESTS
       KeyCache::instance ()->update (sig.fingerprint (), protocol);
 #endif
       TRACEPOINT;
     }
 
   if (protocol == Protocol::CMS && decrypt && !m_decrypt_result.error() &&
       !has_valid_encrypted_checksum)
     {
       log_debug ("%s:%s:%p Encrypted S/MIME without checksum. Block HTML.",
                  SRCNAME, __func__, this);
       m_block_html = true;
     }
 
+  /* Import any application/pgp-keys attachments if the option is set. */
+  if (opt.autoimport)
+    {
+      for (const auto &attach: get_attachments())
+        {
+          if (attach->get_content_type () == "application/pgp-keys")
+            {
+#ifndef BUILD_TESTS
+              KeyCache::import_pgp_key_data (attach->get_data());
+#endif
+            }
+        }
+    }
+
   if (opt.enable_debug & DBG_DATA)
     {
       std::stringstream ss;
       TRACEPOINT;
       ss << m_decrypt_result << '\n' << m_verify_result;
       for (const auto sig: m_verify_result.signatures())
         {
           const auto key = sig.key();
           if (key.isNull())
             {
 #ifndef BUILD_TESTS
               ss << '\n' << "Cached key:\n" << KeyCache::instance()->getByFpr(
                   sig.fingerprint(), false);
 #else
               get_and_print_key_test (sig.fingerprint (), protocol);
 #endif
             }
           else
             {
               ss << '\n' << key;
             }
         }
        log_debug ("Decrypt / Verify result: %s", ss.str().c_str());
     }
   else
     {
       log_debug ("%s:%s:%p Decrypt / verify done errs: %i / %i numsigs: %i.",
                  SRCNAME, __func__, this, m_decrypt_result.error().code(),
                  m_verify_result.error().code(), m_verify_result.numSignatures());
     }
   TRACEPOINT;
 
   if (m_outputprovider)
     {
       m_outputprovider->finalize ();
     }
 
   TRETURN;
 }
 
 const std::string
 ParseController::get_html_body () const
 {
   TSTART;
   if (m_outputprovider)
     {
       TRETURN m_outputprovider->get_html_body ();
     }
   else
     {
       TRETURN std::string();
     }
 }
 
 const std::string
 ParseController::get_body () const
 {
   TSTART;
   if (m_outputprovider)
     {
       TRETURN m_outputprovider->get_body ();
     }
   else
     {
       TRETURN std::string();
     }
 }
 
 const std::string
 ParseController::get_body_charset() const
 {
   TSTART;
   if (m_outputprovider)
     {
       TRETURN m_outputprovider->get_body_charset();
     }
   else
     {
       TRETURN std::string();
     }
 }
 
 const std::string
 ParseController::get_html_charset() const
 {
   TSTART;
   if (m_outputprovider)
     {
       TRETURN m_outputprovider->get_html_charset();
     }
   else
     {
       TRETURN std::string();
     }
 }
 
 std::vector<std::shared_ptr<Attachment> >
 ParseController::get_attachments() const
 {
   TSTART;
   if (m_outputprovider)
     {
       TRETURN m_outputprovider->get_attachments();
     }
   else
     {
       TRETURN std::vector<std::shared_ptr<Attachment> >();
     }
 }