> Transport security is not the actual issue. Depends on what you mean by transport security. I agree TLS solves important aspects, but I can still pretend lik

> Transport security is not the actual issue. Depends on what you mean by transport security. I agree TLS solves important aspects, but I can still pretend like I am xylakant@example.com without issues, since most domains (especially corporate ones!) don't enforce strict enough SPF/DKIM/DMARC policies. If anyone can pretend to be any user, I'd say transport security is lacking. In Thunderbird I have a DKIM validation plugin that shows the status below the subject line. I've seen e.g. large global oil companies that don't have any DKIM on their emails in 2016. That means anyone could send emails as ceo@oilcorp.com (or better yet (cfo|ITsupport|HR)@oilcorp.com) to employees of oilcorp and it would look genuine.