@mk, I'm pretty sure you and I are in agreement about SPF vs. DKIM/PGP/SMIME: all of that latter group operate on the message, not the envelope, and verify the origin in a user-compatible way regardless of the delivery path.