MXToolbox also says the DKIM record is valid.
The obvious answer here is probably the correct one. If I email myself (different service provider) directly, then DKIM passes. There's probably a header or something getting munged on the mailing list that I didn't think was part of the DKIM check.
A private Mastodon instance