I'm not saying that cryptography wouldn't help in general, or that it's not incredibly stupid that we're not using it. What I'm saying is you can't just slap crypto on this particular scam to make it go away. These people have insider access to the machines that would likely be used to sign the email. If that is the threat model, it's a mistake to trust anything not delivered in person, signed or not.