Be careful that you don't bounce a bounce message. Otherwise, you can self-DDOS your mail server.
It may be safer, at least in the first few months of trialling this, that instead of bouncing emails, you'd accept them but deliver the message with a big warning that the email was not signed properly, and may have been an attempted phishing, and that the recipient must not act on the email unless they verify any information therein through other secure means.
If an attacker managed to obtain a user's private key, then they would have been deep enough in that person's machine that anything that person does would be suspect, whatever system you're using. So this is not an issue you need to worry about. Additionally, requiring signatures gives you the ability to identify the person who leaked their private keys and discipline/retrain that person. You can also revoke that key easily, while the attacker would have to look for someone else's system to break.
A CA aren't supposed to issue an email certificate unless they can prove the email address control. All public CA publishes their Certificate Practice Statement, which details how they validate someone's identity before signing a certificate for that person. You can choose a CA that have an acceptable CPS and limit your attack surface so your mail server would only trust that particular CA for mails within your domain. If you distrust any public CA, you can also run an internal CA so that you don't need to rely on a third party for your internal employee identification.
Of course only a valid users key is accepted, not *, so allowed keys are whitelisted.
Rather than whitelisting user keys directly, I'd suggest white listing trusted verifier (CA/Web of Trust) keys instead. Only servers whose public keys are certified by the verifier would be accepted by the mail server. This separates the responsibility between verifiers and mail server administrator, and allows you to add/remove people without mail server redeployment/reconfiguration. For example, you can train HR to become your identity verifier, and they'd be responsible for signing and revoking certificates as people come and leave the company.