I think there are better solutions to what you want to achieve.

If S/MIME certs were more readily available you could just spam-filter mail that isn't signed, and use the signer's details to better flag spam automatically.

Interesting.

Why I made this post is to figure out a better solution to what I want to achieve. You proposition here doesn't look like it solves it, but I didn't know about it before. I'll dig into it. If you have any further thoughts, I'd love to hear them.

The solution seems pretty simple to me. First sent email is automatically preceded by a request which the receiver can accept or deny. If deny, all incoming communication is blocked, if accepted sender is added to whitelist. No website or separate approval process needed.

Why have the initial pre-message then? Why not just have a client that prompts on unknown senders?

Edit: or maybe that’s what you meant?

Request was just a generic term for asking permission in some way, a client prompt would work. Preferably logged in some fashion.

I think you could probably do this now with a good enough client and mail processing rules.