That would not have been possible, with the already existing checks.

While the individual messages were not yet signed, Gmail should have already rejected any message claiming to be from my domain that was not sent by my own server.