Which is why GP said: "And if I manage to get somebody else's private key (which happens so often these days, it's not even funny), I can ruin someone else's career while I push my spam."

Also, the biggest problem with PGP-type signing as a mechanism to control spam is not whether you can spoof the signature or not, it's that there's nothing in it that stops the spammer from generating a new identity once the current identity is tarnished.

With NNTP, you pretty much have to login to a system in order to post... this means, you are trackable, and if the origin server is doing the signing, this can be traced... It's generally very easy to trace a message through it's server chain.