Fixed! All this time I thought it was a webcit bug. Turns out it was a bug in the MIME parser, which caused MSG4 to send WebCit an empty message. Putting the MIME boundary as anything other than the very last key in the Content-type: declaration is rare, but quite legal. Fixed now. As a bonus, I moved the extract_key() call from the main header parsing loop to inside the block of code that parses Content-type:, so it should run even faster now.