kasp: Purge deleted keys

Add a configuration option for dnssec-policy to purge deleted keys.

purge-keys duration will purge deleted keys after the given duration. Set to 0 to never purge deleted keys. Default 90 days.