Ralph, I apologize, it has been pointed out that I did not qualify this correctly. It is only the MSH which signs first then encrypts. There is nothing preventing the application from submitting a previously signed or previously encrypted payload to the MSH. Sorry about that. Regards, David.