Author does not mention dkim in article which makes me think he might not "read all the relevant RFCs" as he claims.
Majority of important emails are signed and are not easy to spoof
> DKIM is useful, but limited. All it does is verify that an email which claims to be from paypal.com is really from paypal.com. What it lacks is the ability to show warnings such as "this email wasn't signed, do you want to trust it?" and "this signature isn't recognized, yikes!"
Perhaps such warnings could be accomplished with DKIM somehow (I'd have to study it to see), and if it can: great! But in its current state it's doing something different than what I'm proposing (which is why I omitted it originally).