Federation at the server instance is different from federation at the account instance.
That feels like it is obvious, but still needs saying.
Server federation is email. Account federation is spycraft in cold war Berlin.
The reason why spam is endemic is that server federation must be default-accept to be valuable.
The reason why PKI is hard is that account federation must be default-reject to be valuable.