As bayarrhea points out, a signature doesn't help you if the attack model is "lookalike domain".

Email validation exists; gmail will let you know if email arrived over TLS or not. Validation that the source of an email matches the "From:" header is generally done by checking the domain's SPF record.

https://en.wikipedia.org/wiki/Sender_Policy_Framework

https://en.wikipedia.org/wiki/Email_spoofing#Countermeasures

Encryption doesn’t help Unicode homoglyph attacks. I can send you encrypted messages all day long from google.com, even though they’re not coming from who you think they are.

If you are using web of trust in a gpg style then homoglyph attacks are not particularly effective..

If you are using CAs then homoglyph attacks are the simplest of many attacks based on a system of minimal technical compliance.

if you don't care about unicode domains then mitigation can be very simple using dnsmasq, e.g.:

in /etc/dnsmasq.conf add something like:

  # Add domains which you want to force to an IP address here.
  address=/:xn--*:/0.0.0.0

(in case your dnsmasq doesn't support this then there is a patch here: https://github.com/spacedingo/dnsmasq-regexp_2.76)

You wouldn't be able to sign the fake message with the fake domain unless you compromised the sender's PGP private key, which was not the vector of this attack.

When I use the actual second party's public key, the decryption won't work though, so you'd be found out immediately, surely?

Exactly so.