My CSA implementation seems to work OK now (according to my tests). Any more testing, code review, suggestions, bug reports etc. welcome. The following patch is against the code from CVS, but it applies to 4.50 OK.
http://www.cus.cam.ac.uk/~fanf2/hermes/doc/antiforgery/exim-csa.patch http://www.cus.cam.ac.uk/~fanf2/hermes/doc/antiforgery/exim-csa.docs
For those who like tales of woe, search for “gross” in the patch. That cost me two hours!