I don't think federation is the core issue with e-mail. I see the core problem as terrible MUAs don't use nearly enough signals to interpret identity of senders.

SMTP has means to identify servers and domain ownership, web browsers have infrastructure to identify and verify arbitrary websites, and S/MIME exists. Most MUAs ignore basically all of this and instead trust whatever address is in a message's From header.