Removing 'auto-dnssec' does not turn off DNSSEC maintenance
If you reconfigure a zone and remove the auto-dnssec option, the zone is actually still DNSSEC maintained. This is because in zoneconf.c there is no call to dns_zone_setkeyopt() to turn off the flags. If the configuration option is not used cfg_map_get(zoptions, "auto-dnssec", &obj) will return an error.
(this is fixed in d72ad7c5 as part of #1750 (closed))