Easy to acquire, yes, but not anonymously. The cert has to tie back to a domain or subdomain and there’s a process to prove a domain belongs to whomever requested the cert. Long story short, if you wanted to sue or file complaint against a spammer that signs their emails then it’s not really a challenge to trace back to the person or company doing the spamming.
This still relies on domain name registrars, hosts (e.g. Gmail), and certificate authorities keeping proper records.