Hacker News Reader

That explains spoofing of the originating address; to generate a signed email surely you would need a set of certificates.

Oops I missed that. noonat's solution seems more likely then.