dns.conf is missing dnssec-keys feature
dns.conf and add a test for dnssec-keys and deprecated managed-keys and trusted-keys.
Copied the relevant text from that discussion here for convience:
Seeing the change in dnsconf.c makes me realize dns.conf is probably broken - it doesn't have managed-keys or dnssec-keys in its clauseset, though lib/irs/dnsconf.c seems to assume they might be there. I think you should omit the change to that file in this MR, but we should open a new issue to fix dns.conf and add a test for it. (Or consider removing the feature; it seems unlikely anyone's depending on it.)