Neither can I find out a technical description what is actually certified and how. Email seems like a very insecure concept. How do they verify who controls a mailbox/email address?

Signing message contents I understand. But email headers can be faked in various ways.