On: Using Encryption and Authentication Correctly

Actually Rogaway's new AEZ proposal for CAESAR has a sort of MtE: http://web.cs.ucdavis.edu/~rogaway/aez/aez.pdf

The "MAC" here is just a block of zeros, and if decryption successfully reveals such a block of zeros, then it's deemed authentic.

This is a pretty specific quality to their construction though, and it doesn't really work elsewhere.

Yep. "Generic composition" (taking independently designed MACs and cipher modes and rolling your own AE) is my cop-out in case 'pbsd shows up to correct me.

Generally, though, and without intending snark:

If you're discussing MTE v ETM, and Bruce Schneier comes up, the answer is ETM.