I also realised a while ago that most emails are just transactional now (password resets, how well did we do the thing you paid us to do?), so I do similar to you without the sender input and it more or less works. Breaks down like this:

- Nobody gets into my inbox unless whitelisted address. Instead of fighting spam and blacklisting, I know my inbox is always from someone I want to hear from.

- Every other email goes through spam assassin (which is getting worse) and then into a folder called Transactional (and if it makes a mistake, I add to the whitelist)

- I have another folder SpamAssassin where I move spam, and it gets pushed back through sa-learn

- Finally, I have a cronjob that goes through the email in Transaction and looks for subjects, senders, sending domains or to addresses that have a) been received at least 5 times and b) are only in the spam folder.

So kind of the same idea as you. But I think I'd feel really pretentious using this system and assume that quite a lot of people just rolled their eyes and ignored the rejection.