It has caught my attention that rewritten addresses with SRS are not signed with DKIM, because PMG looks at the domain after @ instead of the rewritten domain:
not DKIM signing mail from SRS0=duAC=HO=cyberfusion.nl=wedwards@prorelay.nl
So in this case, email from cyberfusion.nl is signed with...