[fanzhang]

Your solution would work well if everyone (or nearly all people) agreed to migrate to it.

It may need to be in a few steps. The first step might be, for a 5 year period, mail clients display a warning saying the sending domain doesn't have the correct SPF records. Then after that, those mail clients dropped those emails.

Overall, the cleverness of the OP solution is that it uses to current system to make the next iterative step in solving the problem in a backwards compatible way.

If we could break backwards compatibility, I think we can solve a large number of issues with email wholesale.