Maybe you can expand a bit on how the receiving MTA can have certificates (both for the HTTPS part and the SMTP-TLS part) that are signed by a CA trusted by the

Maybe you can expand a bit on how the receiving MTA can have certificates (both for the HTTPS part and the SMTP-TLS part) that are signed by a CA trusted by the sender? Currently we have only one system for doing that (at scale) and that is the current global PKI system. The situation would have been much worse 10 years ago because many organizations were not using HTTPS at the time, partly because obtaining certificates was expensive and a lot of work. DNSSEC has a single root which is recognized by everybody doing DNSSEC. In contrast, the collection of TLS CAs is only losely defined. For example, there is a java application that I use. The java libraries do not recognize the CA used by the Dutch government. So after each update of the libraries, things start failing again. We can expect the same for MTA-STS unless everybody sticks to the CAs that are trusted by common browsers. Bottom-up security doesn't work on a global scale. It somewhat works for ssh, because that is mostly local. It completely fails to work at scale for pgp.