I see how to use a signed variable for email now.
Where a url is supplied in an email for a user to get via a browser, standard export_vars -sign -url ... applies.
Where input requires authenticating a reply and obtaining associated form inputs, pass the uniqueID mapped to the inputs, where the uniqueID is signed using export_vars and adjusted to fit email message-id specs.
This keeps from leaking data, and message-id is re-generated using existing code.
Thank you, Gustaf!
That makes the implementation much cleaner.
