It seems like header modification is only allowed before signature check in lua, and then only as a temporary operation not passed on to the target mail daemon:
Note that this only changes the content of the header field used when generating or verifying the signature; the actual delivered message is not modified.
It would be nice if odkim.replace_header(ctx, name, n, newval) and odkim.add_header(ctx, name, value) and odkim.del_header(ctx, name, n) were available in the final script, and in a way where it persists for actual delivery. I understand this is not at all the intended core use for OpenDKIM, but since it already has this great flexible Lua API this would open up the door for doing many rewriting and administrative tasks in a simple Lua script that may otherwise be relatively cumbersome to set up using different postfix submission queues. Especially if the rewrite logic is meant to be relatively complex.
I understand if this is too far out of scope. I just thought the idea would be too useful not to try to suggest it. Thanks so much for working on OpenDKIM, and sorry for taking up your time.