[exim] Using the SRS support in Exim 4.50+

I'm in the process of revamping my company's mail system. We allow shell
account clients to host domains with us, and they can use filters to deliver
mail locally or forward it on to another address elsewhere. A simplified
version of what we currently do could be summed up with the two Exim4
routers:

remote:
driver = dnslookup
domains = ! @mx_primary
transport = remote_smtp
ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
no_more

local:
driver = redirect
allow_fail
allow_filter
check_ancestor
user = ${lookup {$domain} DIRECTUSER {$value} fail}
initgroups
data = ${lookup {$local_part@$domain} DIRECTDATA {$value} fail}
qualify_preserve_domain
directory_transport = address_maildir
file_transport = address_file
pipe_transport = address_pipe
reply_transport = address_reply

Sadly, it looks like large parts of the world are set on breaking SMTP email
with SPF, which will cause problems for messages that we forward elsewhere.
(We're already starting to see some problems along these lines.) It looks
like the only option available is mangling the envelope sender for mail that
gets redirected to an external address.

Conveniently, SRS support has just gone into Exim 4.50, so I'd like to try
using this. However, it's not clear to me how to use the options available
to express the behaviour I'd like. I don't want to mangle the sender for
mail being delivered to local mailboxes or pipes (directly or indirectly
after a couple of hops through the local rewrite router) so presumably
putting an 'srs = forward' option on the local router above is way too
general. My first guess is a srs router in front of the remote router,
something like this:

srs:
driver = redirect
domains = ! @mx_primary
data = $local_part@$domain
srs = forward

but this seems very clumsy---rewriting to an identical address just to get
the srs side-effect!

Ideally, I'd also like to be able to specify an srs_condition that checks
the SPF records for the envelope sender and doesn't rewrite if they're
absent or if we're allowed to emit mail from that sender address. The 'spf'
condition is available within ACLs, but as far as I know, it isn't possible
to call an ACL to test its result from within the string expansion mechanism
is it?

Thanks in advance for any pointers anyone can provide.

Best wishes,
Chris.