They can, but domains are easy to spoof, which leads us to operators having to decide to accept unsigned domains and risk bad actors getting through to the filt

They can, but domains are easy to spoof, which leads us to operators having to decide to accept unsigned domains and risk bad actors getting through to the filters and milters or rejecting well meaning but unsigned email servers into federation. That's a problem that can be fixed from the get go if you design a federated system that doesn't assume all actors are charitable. The major players could cut down on a huge amount of spam by only accepting signed domains, but email wasn't designed to force all email through only it's home server, so that's not as backwards compatible as you'd like. That's not however a strict federation problem, it's more of an 'email was designed to assume everyone is a good actor, before we had much proof to the contrary' problem.