DKIM signing config EXO while using Cisco CES for all internet emails

Hi,
We've got Exchange Online to host our mailboxes, and configured our internet send connector to pass via a Cisco CES.
So we aren't delivering directly to the internet via Exchange Online.

DKIM signing is enabled on the Cisco CES.

I'm quite sure we never had issues with our DKIM signing, but did notice we do now.
In our EXO DKim config we have DKIM disabled for all our custom domains.
On the OnMicrosoft I see that it's still enabled.

We have DKIM signing errors when I check the headers of emails, and the reason is that EXO is already signing with the default domain.

I always thought that DKIM signing should occur on the last servers before delivering to the internet, which is our Cisco CES.

I opened a ticket at support, and they keep telling me I need to enable DKIM signing on EXO for the custom domain..
I really don't see why? Why can't we just disable dkim signing on all custom domains and the onmicrosoft domain and let CES take care of it? 
Also I'd expect it to be done there, as those are our last servers before internet.