OpenBSD's filter-dkimsign signs everything for a domain. If someone sends a mail and claims it's from root@example.com, a real RSA signature would be attached onto it. The official way is running the filter only on the Unix socket, not on TCP, but there will be no signature from users logged in from the Internet. Worse, smtpd's filter chain can theoretically stop it via rejecting "!auth", but mixing internal and external filters are not supported, so it doesn't work... Time to patch filter-dkimsign.