This is great! As a sysadmin I'm just curious what other domains are using dkim and how. This makes easy to see. I like it even better with the options set to (i) highlighting on, even for unsigned emails (I make 'em pink); (ii) and display-even-when-testing on (many big domains leave testing on, e.g., comcast); (iii) show DKIM header when an email is viewed, so that you affirmatively get a message even for unsigned emails. So I'd move to make those the defaults. Separately, note to the developer since it might be in your skillset, if you created a DMARC filter extension (i.e., send to junk those messages that fail senders DMARC policy) for Thunderbird that would be bomb. It's probably best done by the MTA, but a client side options is always neat to have.
This review is for a previous version of the add-on (0.6.0).