Support user generated DKIM keys for strict DMARC alignment
dmarc.org lays out several strategies for integration with third party senders; your current implementation allows option 1.1, which means that you can use a subdomain (e.g. mx.example.com) to send mail from @example.com and pass DMARC with relaxed alignment.
However if the organisation wants to use strict alignment this will fail (mx.example.com matches example.com in relaxed alignment, but fails in strict alignment). Option 1.2 would allow this by having your customers generate a private DKIM key for example.com and providing it to you so that you can generate DKIM signature for example.com with it when sending from mx.example.com.