> someone steals your laptop
I wonder how well the non-repudiation would actually hold up in that scenario. If you self host your mail server, the attacker could possibly steal your private key and forge the emails. So you might actually have repudiation. Or does DKIM have a timestamp? If not the attacker can simply send an email from your laptop and get it signed by your mailserver. Thus another route for claiming repudiation.
I'm not sure how common it is, but my mail server in particular doesn't store the signed emails, and I went to no special effort to set things up that way.
Of course, if someone replies to me and quotes my email to them, that will be signed by their server's key.
I'm not sure what you're saying. Whether or not the mail server stores emails has no bearing on what I said.
My reply was more to what tptacek said - observing that for at least some configurations a stolen mail spool from a laptop won't have signatures on sent emails.
It's easy to see an example scenario: someone steals your laptop, then posts your mail spool publicly. You'd like to be able to say "you can't trust any of these messages", to mitigate the damage.
What I think confuses people is the fact that there are settings where non-repudiation is crucial to the security model. We're used to abstract cryptographic promises that apply universally to all systems. But this one doesn't.