@ska How I send is with mxclient, but I have a wrapper that backgrounds and retries according to schedule. No crossing of privilege domains; it runs as user. I do want to enhance mxclient to support SOCKS and ssh -W transport.

How I receive is with a tiny program that parses SMTP (including BearSSL for STARTTLS, which is mandatory per DANE) to determine the user to deliver to and pipes the mail contents to the user's configured acceptance program, which can dynamically produce temp or permanent failure (which the sender sees at SMTP time) via exit codes.

There is 100% backpressure everywhere in the system, no queues, no backup MX's, no MITMs. During down time it's the sender's responsibility to keep the mail and retry later.