This is really a restriction of the CONFIRM procedure that has been filed
as "something to take care of later" because, when you import a brand new
mailing list, the list is by definition empty and you don't really *need*
the higher degrees  of security until after the IMPORT  job has been run.
We do intend to  remove this restriction, possibly in 1.8c.  It is only a
technical difficulty, not a design decision. I agree that it is broken.
 
  Eric