Reject master zones with DS records at the apex.
DS records belong to the parent zone and should never appear at the zone apex. Reject zones which have a DS record at the apex when loading if they are a master zone.
ISC's operations managed to do this.