HN user
If you are talking about SPF and DKIM, none of them verify the sender. The former indicates which IP adresses are allowed to send a email from for a specific domain name. The latter lets you verify that the email originated from the domain. But not from the sender itself.
If you were talking about PGP signatures, ignore my previous words :)
The issue you see in SIP predates voice over IP. PSTN suffers from the very same issue.
It's not a hack. Think of Asterisk as if it was an http server + backend code. How do you scale?
You scale horizontally using proxies (kamailio dispatchers), (what you would call "reverse proxies in the http world), and use external storage / database / logic.
The world is also moving to hosted communications (Twilio, etc) so there is less and less need for a local PBX, thus less demand for Asterisk.
Correct, but don't forget many hosted communications services use asterisk internally.
Twilio did use Asterisk in the past, although I believe they have switched to something else.