Removing 'auto-dnssec' does not turn off DNSSEC maintenance
If you reconfigure a zone and remove the
auto-dnssec option, the zone is actually still DNSSEC maintained. This is because in
zoneconf.c there is no call to
dns_zone_setkeyopt() to turn off the flags. If the configuration option is not used
cfg_map_get(zoptions, "auto-dnssec", &obj) will return an error.