Bugs:
 - dkimfilter.in exits after a while, saying "Alarm clock" (not sure if this
   still happens)

Possible bugs:
 - if signature fails on an email using a subdomain of the key's domain,
   policy lookup should be for key's domain, not sender domain (i.e.
   sender domain should only be used if the key domain doesn't match,
   or there is no signature)

Desired features:
 - support use of multiple signatures, selectors, private keys, etc.
   (the signing process would use a lookup table of some sort, using the
   sender address's domain to pick signature attributes to use)

Possibly desired features:
 - sign/verify in the same program - although...
     - messages coming from within the organization should be signed
     - messages coming from outside should be verified
   having one program do both actions requires it to know which way the
   message is going, a decision I don't want to be responsible for

DKIM support:
 - verifier
     - allow more control over selecting which signature to use
     - allow more control over handling non-passing DKIM messages
       (i.e. look up the sender policy and apply)
     - allow more control over handling passing DKIM messages
       (i.e. use a pluggable reputation system)
 - filters
     - determine way to indicate what headers should be removed

Testing:
 - test what happens if DNS is unavailable when fetching key or domain policy
