OK, https://support.google.com/a/answer/81126?hl=en has even more information. "ARC checks the previous authentication status of forwarded messages. If a forwarded message passes SPF or DKIM authentication, but ARC shows it previously failed authentication, Gmail treats the message as unauthenticated."
Have to investigate https://github.com/postalsys/haraka-plugin-mailauth .
But long story short, @vadim unfortunately the situation is gmail forwarding is probably not going to work until we implement this. I have no ETA to implement this feature.