We should reuse the Enigmail code that already implements this part. However, we should allow it use an integrated library as the OpenPGP engine.

My initial testing/porting of the Enigmail code looks good, in bug 1603519 I'm able to send outgoing encrypted email, also tested with big image attachment.

Currently, when sending an email that is both signed and encrypted, enigmail will use the combined package format.

However, it would be good to be able to use two different engines for private key and public operations (sign with one, encrypt with the other). This might be helpful when using a different engine that can be used to access a smartcard for private key operations, but using the integrated engine for all public key operations.

I think that doing so would require us to create two separate MIME layers, one for the inner signed layer, another for the outer encryption layer.

I wonder if we should be consistent and always use the two layer approach when sending out messages - or if we should use combined by default, and only use two layers when we're using different engines for signing and encryption.