Of course, this scheme only works if the leaked emails are published at least 10 days after the day the email was sent. If we build non-repudiation into the DKIM framework itself we can do better, as this paper does.

https://www.mit.edu/~specter/assets/pdf/sec21KF.pdf