The solution seems to be to ensure the mailing list
system detects
DKIM/DMARC and, if needed, change the sender. If this sounds like an awful
hack to you, you'd be right, but it seems to be all we have. I understand
the mailing lists might be moving to a different provider soon, so perhaps
this gets fixed by the change?
Currently our lists detect and verify dkim/dmarc and re-sign with ARC but it
seems some providers are still not reading the ARC headers properly.
I wanted at one point to add a Sender header with re-signed DKIM but
mailman3 doesn't support that, preferring to push ARC adoption or else fall
back to the full from-header rewriting and enveloping style.