For this specific task, we can collapse a lot of that on the web. Adding a gpg key ring or some other suitable structure to the .well-known URL list [1] wouldn't be that big a deal. This is easier than solving the problem of securing all emails. For verifying signatures you don't need any keys of your own, so 2 & 3 are irrelevant, and the .well-known URL can have revocations in it too.

But it's still plenty hard to ensure that we don't show an email as validated as definitely being from amazorn.com, along with some other funny business that could be pulled.

It does tend to get the problem down to an already existing set of problems, though. It could also be the "killer app" for GPG emails.

[1]: https://tools.ietf.org/html/rfc5785