Well there are a few different big failures, from not signing the To: to allowing long arbitrary content in an email sent from a legitimate Google address...
But I think Google sites is the most important one because it makes sites look like they are actually Google wherever one comes from, it could be a pop-under loaded by another site or whatever, I think it's a more universal avenue for phishing than just exploiting DKIM.
