We could really do with more control of DKIM, for example...
Ability to control key length 1024Bit or 2048Bit (server wide)
Enable subdomain signing, while you can't create email accounts for subdomains in Enhance, it's often the case that the server is named as a subdomain eg: mail.example.com Which means unsigned mail leaving the server (cron etc) even when example.com is hosted.
The standard OpenDKIM package allows you to add it to nonsmtpdmilters so sendmail mail gets signed.
Ability to change the selector.