> 1. The truthfulness and reliability of the historical record is important. [...] Everybody agrees here, but how does one gets to decide that Google, a privat

> 1. The truthfulness and reliability of the historical record is important. [...] Everybody agrees here, but how does one gets to decide that Google, a private corporation, is the one to decide that a given email is an accurate historical email? An email provider is a defacto certificate authority? Are these dkim keys subject to the same standard of care as private keys that CAs manage? For your regular-person scenario, having a way for a 3rd party private company "certify" an email sent from another private company (example: your online order) may be good enough, but is it good enough in every scenario?