Comment by dingaling

But that's all delicately balanced on trusting the Via headers. If you are under attack from someone malicious then that seems unwise.

It's like relying on the From: header in an e-mail.