DKIM signature could be used to verify that Canvas' server sent the email with the given content

Good luck having people forward an email a) with headers and b) in a way that doesn't break the signature...

And who exactly do you think is going to verify 100s of thousands of emails this way dude?

A computer?