This is really a restriction of the CONFIRM procedure that has been filed
as "something to take care of later" because, when you import a brand new
mailing list, the list is by definition empty and you don't really *need*
the higher degrees of security until after the IMPORT job has been run.
We do intend to remove this restriction, possibly in 1.8c. It is only a
technical difficulty, not a design decision. I agree that it is broken.
Eric