I use Gmail. When I receive an email, Gmail displays the sender's email address. So far I've always looked at this address when receiving sensitive mails, to avoid phishing. For example, I know by heart that PayPal's site is paypal.com so I just check that the email indeed comes from a paypal.com address. I always thought this is sufficient as a security measure.
Now, though, I read the "Authentication icon for verified senders" Gmail support article. It seems to say that my described practice is not enough and I should also enable the mentioned "lab" and look for the "key" icon every time.
My question is, why should I do that?