This is going to sound funny, but is there a way to sign only certain emails (out of all emails a user sends) instead of signing all messages with DNS based verification?
I should mention specifically in a way that’s at least decently user accessible; ruling out GPG.
You can always sign based on specific rules via your MTA to sign some and not sign others. You can also send from many sender's (say allocated by spf allow rules) that aren't signed at all but matches the IP ranges allowed.
I should mention specifically in a way that’s at least decently user accessible; ruling out GPG.