I am not sure I agree with mailing lists. I don't think the email needs to look like it is coming from a user. There is nothing wrong with the email looking like it is coming from the mailing list itself (unless I misunderstood what you mean by mailing list being a problem).

You can't ask regular users to run pgp themselves. This is a prime example of the sort of technical details that a user shouldn't be asked to even understand or be aware it exists.