Yes (just like with email, or Twitter where the owner could impersonate anybody)

It isn't really the same as email, because with the email it doesn't matter if you are on the same domain as other people. You can avoid this risk by hosting your own email but running your own Mastodon instance just for yourself wouldn't make much sense.

It's exactly the same as an email server. Whomever owns the server can send email from your address therefore impersonating you as per the original question.

It's the same in that way, yes: both are federated protocols where you need to trust the owner of your server. But with Mastodon there are within-server interactions like the local timeline (https://cfenollosa.com/blog/you-may-be-using-mastodon-wrong....) that have no equivalent in email, so if you decide to try to avoid this risk by self-hosting you're giving up something that a lot of Mastodon users really enjoy.

My Mastodon instance can exchange messages with yours, similar to my mail server sending you messages to you. See ActivityPub protocol.

Mastodon is federated, but by running an instance just for yourself you give up on per-instance culture

With email, I can use something like gpg to sign it. Can you sign Mastodon posts?

You can sign anything with gpg - or layer on OTR - but it's not baked in AFAIK.