Release Mail Tools 0.2.0

docs/PRIVACY-SECURITY.md

@@ -5,9 +5,16 @@ memory. There is no storage, telemetry, analytics, remote-resource request or
 server integration. Closing/reloading the page clears the workbench.
 
 Limits reduce accidental resource exhaustion but do not make Mail Tools a
-forensic parser. HTML loses links, styling and embedded resources by design.
+forensic parser. HTML loses links, styling and external embedded resources by
+design; only bounded safe image parts referenced by `cid:` can be embedded.
 Downloaded attachments remain untrusted. Authentication results and Received
-headers are self-asserted text; no DNS or cryptographic verification occurs.
+headers are self-asserted text.
+
+The optional DKIM lab performs local cryptographic verification against a DNS
+TXT value pasted by the user. It never resolves DNS, so a passing result means
+only that the message bytes match that supplied key. It does not prove that the
+key is current, authoritative or obtained securely, and it does not turn other
+authentication headers into verified evidence.
 
 Focused redaction removes a fixed set of top-level transport/authentication
 headers. It does not rewrite nested `message/rfc822` content and can leave names,