To work with signed (and encrypted) messages successfully, you need to understand something about the behavior of an InputStream. InputStreams are transient forms of data in a flow service. When a service reads an InputStream, it immediately discards the data within it. This means that once you process a MIME message with createMimeData, the message no longer exists in the original InputStream object.

This poses a problem if, after running createMimeData on the InputStream, you discover that it contains a signed or encrypted message. Because the original InputStream has been emptied, it cannot be passed to the signature-verification or decryption services. To solve this problem, createMimeData returns a copy of the original InputStream in an output variable called stream. This is the variable you pass to processSignedData if, after processing the original message with createMimeData, you discover that it is signed.