> you don't need a verifiable DKIM signature to know if the message had a valid DKIM signature when it was sent.

You seem to be trying to say that "the fact that it was delivered proves it had a valid signature when it was sent".

That presupposes that the headers indicating when it was delivered are correct, or that it was delivered at all in the first place.

I don't think you understand the attack.

I sent Thomas an email admitting to something scandalous.

A few months later, Mallory pops the server Thomas's email is stored on, and extracts his mail spool.

Mallory wants to prove to a third party that the email is authentic and not a fabrication.

I know it's real.

Thomas knows it's real.

Mallory is pretty sure it's real.

Alice, a reporter for the Daily Bugle cannot verify it is real, rather than Mallory's forgery.

I can claim it's a forgery, and point out that Mallory could have made it up and generated the signature with the published key.

Now, I may have a problem if it were a crime rather than something merely scandalous because then Bob, an FBI agent, decides to subpoena some logs and maybe prove when it was sent, but even so, logs typically don't have message content or even a hash of the message content.