Mail is signed twice because Postfix receives it twice. I suggest that you correlate the Received: headers with the DKIM signatures, and decide where to enable DKIM signing. It may be easier to configure this per-service in master.cf than globally in main.cf.
Wietse
