cleanup dnssec-keygen manual page
Alphabetize options and synopsis; remove spurious -z from synopsis; remove remnants of deprecated -k option; remove mention of long-gone TSIG support; refer to -T KEY in options that are only relevant to pre-RFC3755 DNSSEC; remove unnecessary -n ZONE from the example, and add a -f KSK example.
Edited by Evan Hunt