Thanks Tom.
Actually I think I found a solution (immediately after posting here of course).
I just use my mail server (previously used mostly for receiving mail) to also send mail changing postfix/main.cf to add relayhost = outbound.mailhop.org:587 and added creds to postfix/sasl_passwd.
Then I added my mail servers fixed IP to spf and let DuoCircle handle DKIM.
Kinda convoluted IMO but I recon it’s a fairly typical delegation of responsibilities. It’s just because I’m one guy that this all seems terribly overkill to use two separate servers to handle a few emails. I suppose the real issue is that email is unusual in that there are no pre-established trust relations between authorities. It’s amazing it works at all.
Mike