code: def _handle_signatures(original, message, params):
      
      malformed = None
      if len(message.get_payload()) != 2:
          malformed = u'expected exactly two messages, got {0}'.format(
              len(message.get_payload()))
      else:
          ct = message.get_payload(1).get_content_type()
          if ct != _APP_PGP_SIG:
              malformed = u'expected Content-Type: {0}, got: {1}'.format(
                  _APP_PGP_SIG, ct)
  
      # TODO: RFC 3156 says the alg has to be lower case, but I've seen a message
      # with 'PGP-'. maybe we should be more permissive here, or maybe not, this
      # is crypto stuff...
      if not params.get('micalg', 'nothing').startswith('pgp-'):
          malformed = u'expected micalg=pgp-..., got: {0}'.format(
              params.get('micalg', 'nothing'))
  
      sigs = []
      if not malformed:
          try:
              sigs = crypto.verify_detached(
                  message.get_payload(0).as_bytes(policy=email.policy.SMTP),
                  message.get_payload(1).get_payload(decode=True))
          except GPGProblem as e:
              malformed = str(e)
  
      add_signature_headers(original, sigs, malformed)
docs: Shared code for handling message signatures.
  
      RFC 3156 is quite strict:
      * exactly two messages
      * the second is of type 'application/pgp-signature'
      * the second contains the detached signature
  
      :param original: The original top-level mail. This is required to attache
          special headers to
      :type original: :class:`email.message.Message`
      :param message: The multipart/signed payload to verify
      :type message: :class:`email.message.Message`
      :param params: the message parameters as returned by :func:`get_params`
      :type params: dict[str, str]