If you are talking about SPF and DKIM, none of them verify the sender. The former indicates which IP adresses are allowed to send a email from for a specific domain name. The latter lets you verify that the email originated from the domain. But not from the sender itself.
If you were talking about PGP signatures, ignore my previous words :)
The issue you see in SIP predates voice over IP. PSTN suffers from the very same issue.
It's not a hack. Think of Asterisk as if it was an http server + backend code. How do you scale?
You scale horizontally using proxies (kamailio dispatchers), (what you would call "reverse proxies in the http world), and use external storage / database / logic.
If you were talking about PGP signatures, ignore my previous words :)
The issue you see in SIP predates voice over IP. PSTN suffers from the very same issue.