Importing from Autocrypt-header runs before decryption+validation,
because that header isn't encrypted and the key is possibly useful for
signature validation.

Importing from attachments runs after decryption+validation (because the
attachments might be encrypted). If a key was imported, and if a signature
is present that could not be validated before, then the signature
validation if repeated.