But it's still plenty hard to ensure that we don't show an email as validated as definitely being from amazorn.com, along with some other funny business that could be pulled.
It does tend to get the problem down to an already existing set of problems, though. It could also be the "killer app" for GPG emails.
The user doesn't need to understand any of this. The user does not need to sign his emails. He just needs a mail software that can handle signatures from well known organizations, and can warn you when the signature doesn't match. Just like my browser puts a green or red symbol when there's a problem with the certificate.
Everything you list is mostly orthogonal to the submission.
What makes an organization "well-known" enough to be on this list? What happens if an organization is not on this list? What if I'm a completely-legitimate (S-Corp paperwork filed!) organization called amazorn.com?
And what problem does this solve that the current DMARC system does not?
That's just the tip of the iceberg in difficulty.
There's also:
0 - understanding the web of trust
1 - verifying that the key you exchanged actually belongs to the person/entity it purports to be from (ie. verifying identities of keyholders and verifying key fingerprints over an out-of-band communications channel).
2 - keeping your own secret keys secure
3 - making and keeping offline backups of your keys
4 - understanding why, how, and when to issue and use key revocations