I wasn't aware of ARC, an extension of the #DMARC protocol that allows for chaining of DMARC checks: When all systems in an #email forward chain support ARC, the forwarders can now prove that they verified the original DKIM signature as valid, and the final recipient can in turn verify the ARC signatures.
This finally makes the operation of mailing lists under DMARC feasible (though for me, it means that I'll have to switch to a different MLM)...
https://dmarc.org/presentations/ARC-Status-March-2017.pdf
https://datatracker.ietf.org/doc/draft-ietf-dmarc-arc-usage/?include_text=1