[snip]
pass. Without cryptographic signatures, you can't really be sure
that a message is authentic.
Not necessarily - there's other ways than signatures. It's dangerous
to suggest that's the only way to do it - not to mention feeding into
the hands of the domainkeys concept which also happens to spell the
death of forwarding services and anything else "in the middle".
The concept of "authentic" is sufficiently undefined that in fact
cryptographic signatures are not even a suitable solution for this
purpose.