Weakness: If an attacker has already compromised an employee's computer and installed a keystroke logger to obtain the employee's pass phrase, he can send digitally signed email that appears to be from the employee.