So, the problem is that DKIM/SPF doesn’t check end-to-end invariants, and instead checks a property that few end-users understand, and that zero end-users care about.