Mostly meant SPF/DKIM to verify the sender is authorized to send emails for a particular domain. Verifying that "it is actually the person Karrot_Kream who wrote that email" is harder; but I don't think you can blame that on the SMTP protocol.