Wouldn’t the spoofing issue be resolved by having SPF records, the receiving mail providers validating SPF, and the origin mail provider requiring auth for thei

Wouldn’t the spoofing issue be resolved by having SPF records, the receiving mail providers validating SPF, and the origin mail provider requiring auth for their SMTP server? That would seem to ensure the sender without requiring end users to manage GPG keys or validate signatures.