I do, in fact, use the DKIM milter - and that might actually be the problem, I'll try disabling it in the sendmail.mc and see if my header still gets removed.
I guess I could have it signed by the milter but we want to have a more flexible approach by implementing our own signer functionality so that the signed messages can either be sent to the system-wide sendmail (the way it's handled now) or back to OpenEMM's own sendmail process. The problem is that OpenEMM uses a home-brewed sendmail implementation and the various parts of the mailer functionality (such as generating the mailings, adding headers, passing the mailings to the MTA...) are distributed on several different parts of the source distribution, implemented in Java, Python and C. As im somewhat proficient in Java, I tried to implement the signer functionality in the source code but finally gave up as it turned out that that solution would be far more complicated and thus time-consuming than I had assumed initially. It's feasible but I need a quicker solution, at least for the time being. So I got the idea to interrupt the sending process, grab the generated mailings, sign them and move them on to the system-wide sendmail process.
In fact, I had totally forgotten about the DKIM-milter and anyway it doesn't appear to be correctly set up as my outbound mails don't get signed. But the plugin might be responsible for removing the headers.
Anyway, thanks for your reply. I will post my progress here.