So, why not simply sign ALL company email using PGP or other tool?

Your company, your rules. Just do it. Anything not signed by the right key is a spoofed email.