Would you call this a back-door replacement for S/MIME and
PGP - since presumably the "ends" are likely to be UAs rather
than edge servers? If so, why burden an edge-protocol, as you
put it, with an end-to-end requirement?
Yes and no. It is very clearly positioning the DKIM message format as a
replacement for S/MIME and PGP Signature. But at the same time XKMS
fills in the missing receiver side policy mechanism required to make
broad scale adoption of S/MIME and PGP encryption possible.
The point being, 2) doesn't seem relevant to our task.
Probably not, but we have to demonstrate that the policy mechanism is
capable of supporting this transition.
That leaves 1) which shows xmks as an adjunct to DNS rather
than an alternative.
Which is by far the most interesting near term application. The question
was how to understand q=xkms rather than q=xkms,dns though.