we were adding the missing date and/or message-id header, but didn't sign it.
and the default dkim signing config is to (over)sign those headers. so that was
causing errors with bad signatures.
found while setting up automated tests for quickstart, while sending a very
basic message between a fresh install.