dkim_keys verifiedcriticalWritten by the Hub

Each row is a key plus how it should be used. The key itself is stored in the database in plain text, which follows from the design — every node of the cluster must be able to sign, and the database is what they share. It also means a database backup contains signing keys, and –purge-database destroys them irrecoverably. A key alone signs nothing: dkim_patterns decides which messages it applies to. We verified the whole cycle on the stand — key, pattern, then a delivered message carrying a valid signature with exactly the algorithm and canonicalisation configured. The enforce column does not mean what its name suggests: the console derives it from the algorithm choice, and with Auto-detect the engine queries DNS for the published key at startup.