dkim important
Sign this message with a given key
Signing keys carried by the message itself — domain, selector, key and all the signing parameters — instead of being taken from the cluster database.
In detail
The alternative to storing keys on the node. A job can carry its own key, which means a multi-customer installation does not have to put every customer's private key into a shared database that every node and every console user can read. That is a genuine architectural choice rather than a convenience, and it cuts both ways: keys in jobs travel through the broker on every message, and whoever can read the queue can read them. Keys in the database sit in one place, protected by database access, and are destroyed by one careless command. Hub already generates and stores DKIM keys for PowerMTA nodes, so either arrangement fits; the decision should be made once, deliberately, and written down.