In addition to the MacroList option, it would be nice to have an additional option to be able to specify macros and values that would indicate messages should be verified only and not signed. This should make it pretty easy to do signing and verifying from a single OpenDKIM milter instance (which, at least for postfix users) is currently complicated.
I plan to implement this in the Python implementation I'm doing using MacroListVerify as the option name. It'd be great if you used the same one so people can easily switch back and forth.