You don't "rewrite" the destination (the "To: <address>" header); you just forward the email along using another "RCPT TO: <address>". How do you propose that

You don't "rewrite" the destination (the "To: <address>" header); you just forward the email along using another "RCPT TO: <address>". How do you propose that you "rewrite" headers without breaking DKIM? Any header included in the message's DKIM "h=to:from:... " stanza cannot be changed; they're included in the DKIM signature. You can simply textually include the entire original email in a completely NEW email message, that is DKIM-signed by your intermediate (forwarding) MTA -- but that's not "forwarding", at all -- that's just "sending an email". Is this what you're describing?