Improve dnssec-policy documentation

• I don't see a mention of default or none in the ARM

• Document that multiple rollovers at the same time is not supported (roll a key that has not yet been made active).

• Key rollovers and timings around submitting the DS

• minor typo: should be "of" not "or" Like max-zone-ttl, specifies the maximum permissible TTL value in seconds. When loading a zone file using a masterfile-format or text or raw,

• Document that PT0S (duration of 0 seconds) is infinite key lifetime

  I'm trying to make it do insane things and I'm not sure why it isn't?  I gave it a zsk lifetime of 6 hours, 
  and publish-safety 1 week.  shouldn't it be prepublishing about 28 keys?  but it's only created two zsk's and 
  only published one
  
  You are pushing it to its limits and basically says: "I am afraid I can't let you do that Dave" - It follows 
  the policy and does one ZSK at a time. The lifetime for the first key will be 6 hours extended with a week. It 
  is not according to policy but as close as it safely can be

• We probably need some warning logs when detecting such insanity.

• ...and documentation of what to expect.

Some other suggestions:

• Consider making the 'lifetime' keyword optional, with default zero if unspecified. consider adding 'unlimited' as a synonym for '0'.
• Also suggest making the key-directory keyword optional
• Add algorithm menmonic support so you could say "ksk algorithm ecdsa256;"
• Forbid, or at least warn, if someone specifies a key length with an algorithm where that's predefined. it accepted "algorithm 13 2048" which I believe to be a silly value.
• We need a way, via rndc zonestatus or some other command, to see what the current state of the keys are and when they're going to be changing to a new state (e.g. rumored to omnipresent). the log file says "wait 7500 seconds" or something if you run in debug mode but I haven't found any other way to figure it out
• We need a way, via rndc or some other command, to signal that we have submitted the DS.
• incidentally, why is zone-max-ttl not called max-zone-ttl? it's identical to the zone option and confusing for them to have two different names