[elif]

for many of the emails, including a lot of the important ones, we have DKIM signing proving that the body and most headers were unaltered and came from the sending domain's actual server.

For the rest, there is no absolute mathematical proof so indeed we must rely upon the lack of counter-claims of legitimacy and the validity of the presented facts themselves. Knowing how grey that area can be, WL takes great care to release only when they have high confidence their reputation can't be harmed by claims. It is certainly a higher bar than is set by the anonymous-quote-happy US press.