I imagine some inbound email could be whitelisted automatically, from some authentication tech. If I sign up for mailings, some app (email? browser) can give a one-use cert or id that can be passed back in email headers. If that company sells my email, I can block further emails from that source. It doesn't seem hard.

If you can get people to use centralized anti-spam white lists, you do not need proof of work at all.

But having such list will make email effectively centrally controlled. I would hope we never end up in this situation. The current system is bad, but making it centralized is even worse - just read what happens to businesses when Facebook/google bans them.

I don't think it needs to be centralized. Why not have a white list per account? When you sign up for a list or service you can add certain domains to you personal list.

Of course some of the larger services may offer a default white list for common domains.

So every time I type my email somewhere, I also have to go to my mail provider and pre-emptively whitelist the sender? This does not sound like a very good UX.

I suppose you can have a special system where you have a browser plugin which automatically generates some sort of subscription token and pastes it alongside email into subscription form.. but this will need cooperation from every mail-sending app, and will not handle non-web uses cases at all...

I use Hey.com which allows me to screen first time senders [1] and it works really well. This is in combination to a spam filter.

[1] https://hey.com/features/the-screener/