Backport of !6581 (merged)
This is a revival of now-nonexistent !6648 and the public version of now-closed isc-private/bind9!424.
In an attempt to help with moving this forward, I allowed myself to
rebase the original MR on top of the current version of
turned out to be slightly tricky because of !6730 (merged).
Let's please get this merged before the October code freeze to minimize CI drift between branches.