use "dnssec" log category for: - managed key zone events - DNSSEC key status changes (activation, deletion, etc) - zone signing status