Eg: One CA to validate all signed messages of an organization.
This is not how it works. CA's do not validate signatures on messages. Instead:
The sender composes a message and signs the message using his/her private key, and sends the signed message to the recipient
The recipient fetches the sender's certificate
The recipient verifies that the certificate is signed by a CA that he/she trusts
The recipient extracts the sender's public key from the certificate
The recipient verifies the sender's signature on the message, using the sender's public key
In more detail:
Consider a case where Alice wants to send Bob a message. However, Malory is positioned between Alice and Bob (a MITM), and has been known to tamper with messages. So, Alice wants Bob to be able to verify that it was really she that sent the message, and that the message was not tampered with while in transit, so Alice signs the message using her private key.
Bob can then verify the signature on message using Alice's public key. But, Alice and Bob have never met before, so Bob has no way getting Alice's true and correct public key. If Alice sends her public key to Bob through the network, Malory can simply tamper with the public key the same way that she can tamper with messages. If Malory replaces Alice's public key with her own, unbeknownst to Bob, and dupes Bob into believing that this bogus public key belongs to Alice - then Malory can create fake messages purporting to be from Alice, and sign them with the private key corresponding with the bogus public key. When Bob verifies the signatures using the bogus public key, he will believe that these messages are signed by Alice.
This is why we have certificate authorities. Alice can create an S/MIME certificate containing her public key, then send the certificate to a certificate authority (CA) for them to sign. The CA requires Alice to verify that she is really who she says she is, and that the public key in the certificate is really hers, and that she is in possession of the corresponding private key - and only then does the CA sign the certificate. When Bob receives Alice's certificate, he can then verify the CA's signature on the certificate, and be confident that the certificate actually contains Alice's (and not Malory's) true and correct public key. Then, he can trust that this public key is Alice's true and correct public key, and use this public key to verify messages signed by Alice.