S/MIME: Two signerInfos (one *invalid*, one valid) are merged into a single valid indicator
I found that Evolution (tested with 3.30.2) merges multiple signers into one single "valid signature" UI element even though not all signatures are correct.
The message is displayed like this (sorry for the german screenshot)
When further clicking through the UI, it reveals the bad signature. You can test for yourself with this file: multipleSigners.eml
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information