Oh, I just discovered the SRS rewriting option on aliases. I just enabled it on one of the aliases that forwards to Gmail. The SPF passes now. I think this should work great!
Edit: hmmmm, now I am not so sure. According to Google’s recommendations to administrators, we should not modify the envelope sender. It seems to suggest NOT to use SRS.
https://support.google.com/mail/answer/175365?hl=en