The real trick would be if intermediary MTA servers could make the assumption that any domain without SPF/DKIM/etc. has the same intent ("I'm not supposed to be used for sending email") as a domain that explicitly has these "no-email" records. We could eliminate a huge swathe of spam senders from the web in a single stroke. (Right now we already apply this heuristic, but the output is just a signal for spam classifiers at the receiver, rather than a "drop the mail on the floor" signal at intermediates, the way that e.g. DNSRBLs are.)

If we did make this "you don't intend to send email if you don't have the secure-origin records" assumption, how much would that break email as a system? What old email servers are sitting around sending unsigned mail, that we want to protect/preserve the functioning of (in the same way we keep Internet-realm HTTP transport around in browsers to preserve access to old HTTP-only Web1.0 servers?)