DKIM is working fine when I send mail via Virtualmin's web mail interface. Also it works fine when my email application (Thunderbird) is configured to connect via port 465 (TLS, with password).
Only when I configure Thunderbird to use port 25 without authentication, it sends emails without DKIM.
Not sure if this is a bug or a feature.
Of course, this works only when Thunderbird is connecting to port 25 via Socks proxy, created by ssh. The SMTP server will reject messages from "another network".