Zones signed only using keys without the SEP bit set cannot be mirrored

In order to be successfully verified, every mirror zone is currently required to be configured with at least one trust anchor that has the SEP bit set. This requirement brings no security benefit and thus should be relaxed.