DKIM for Google Apps (but not Appengine)

In the ongoing war against spam, DKIM (Domain Key Identified Mail) seems to be the best candidate so far - if all legitimate email users started it, it would be the end of anonymous spam. This article explains DKIM, why you should implement it now, and how to do this with Google Apps.