Propose a fix for the kskonly bug

This commit has two ideas for fixing the case where the DNSKEY RRset
is signed with the ZSK when the KSK is offline (but the DNSKEY does
not need to be resigned).

1. In sign_apex, don't enforce updating the DNSKEY signatures and
   cause them to sign so that the newly activated keys are used.

   This works, but breaks the autosign test because that has a test
   that verifies a former standby key is now active by checking if it
   has signed the DNSKEY RRset.  If we don't require resigning the
   DNSKEY RRset immediately after activating a new key, this test
   needs to adapt and check it another way.

   Also it is not clear if sign_apex assumes that the apex is
   being resigned regardless of existing signatures.  Only if that
   was documented somewhere.

2. In zone_rekey, when we detect a new active key, don't use it
   to determine whether we need to update apply diff,
   clean NSEC3PARAM, add signing records, update SOA SERIAL, add
   NSEC(3) chains, sign the apex and write a journal.

   It makes sense when doing a full sign or when we have a diff,
   but a change in activation of keys should not require all those
   steps to be done.

   Also this breaks the autosign test the same way as idea 1.
61 jobs for !1686 with 763-matthijs-active-zsk-but-ksk-only in 15 minutes and 39 seconds (queued for 8 seconds)
detached
Status Job ID Name Coverage
  Precheck
passed #197006
amd64 linux
🐞:sid:amd64

00:00:40

passed #197005
amd64 linux
misc:sid:amd64

00:00:19

 
  Build
passed #197017
amd64 linux
asan:sid:amd64

00:03:34

passed #197018
amd64 linux
clang:stretch:amd64

00:02:34

passed #197019
i386 linux
clang:stretch:i386

00:03:25

passed #197007
amd64 linux
docs:sid:amd64

00:00:47

passed #197016
amd64 linux
gcc:bionic:amd64

00:02:20

passed #197008
amd64 linux
gcc:centos6:amd64

00:02:36

passed #197009
amd64 linux
gcc:centos7:amd64

00:02:17

passed #197014
amd64 linux
gcc:fedora29:amd64

00:02:26

passed #197010
amd64 linux
gcc:jessie:amd64

00:02:15

passed #197012
amd64 linux
gcc:sid:amd64

00:02:17

passed #197013
i386 linux
gcc:sid:i386

00:02:21

passed #197011
amd64 linux
gcc:stretch:amd64

00:03:17

passed #197015
amd64 linux
gcc:xenial:amd64

00:01:55

passed #197020
amd64 linux
pkcs11:sid:amd64

00:02:11

 
  Test
failed #197065
amd64 linux
system:asan:sid:amd64

00:07:32

failed #197062
amd64 linux
system:gcc:bionic:amd64

00:07:04

failed #197064
amd64 linux
system:gcc:centos6:amd64

00:08:21

failed #197055
amd64 linux
system:gcc:centos7:amd64

00:07:03

failed #197061
amd64 linux
system:gcc:fedora29:amd64

00:06:49

failed #197058
amd64 linux
system:gcc:jessie:amd64

00:06:40

failed #197057
amd64 linux
system:gcc:sid:amd64

00:07:08

failed #197056
i386 linux
system:gcc:sid:i386

00:08:43

failed #197060
amd64 linux
system:gcc:stretch:amd64

00:07:00

failed #197063
amd64 linux
system:gcc:xenial:amd64

00:06:42

failed #197059
amd64 linux
system:pkcs11:sid:amd64

00:07:04

passed #197040
amd64 linux
unit:asan:sid:amd64

00:01:09

passed #197041
amd64 linux
unit:clang:stretch:amd64

00:00:44

passed #197038
amd64 linux
unit:gcc:bionic:amd64

00:00:54

passed #197022
amd64 linux
unit:gcc:centos6:amd64

00:00:50

passed #197024
amd64 linux
unit:gcc:centos7:amd64

00:00:51

passed #197034
amd64 linux
unit:gcc:fedora29:amd64

00:00:44

passed #197026
amd64 linux
unit:gcc:jessie:amd64

00:00:29

passed #197030
amd64 linux
unit:gcc:sid:amd64

00:00:52

passed #197032
i386 linux
unit:gcc:sid:i386

00:00:50

passed #197028
amd64 linux
unit:gcc:stretch:amd64

00:00:52

passed #197036
amd64 linux
unit:gcc:xenial:amd64

00:00:51

passed #197043
amd64 linux
unit:pkcs11:sid:amd64

00:00:51

failed #197054
linux amd64
system:asan:sid:amd64

00:08:05

failed #197039
amd64 linux
system:asan:sid:amd64

00:08:14

failed #197037
amd64 linux
system:gcc:bionic:amd64

00:07:12

failed #197051
linux amd64
system:gcc:bionic:amd64

00:07:08

failed #197053
linux amd64
system:gcc:centos6:amd64

00:07:06

failed #197021
amd64 linux
system:gcc:centos6:amd64

00:08:09

failed #197046
linux amd64
system:gcc:centos7:amd64

00:06:39

failed #197023
amd64 linux
system:gcc:centos7:amd64

00:06:53

failed #197033
amd64 linux
system:gcc:fedora29:amd64

00:07:09

failed #197050
linux amd64
system:gcc:fedora29:amd64

00:07:06

failed #197047
linux amd64
system:gcc:jessie:amd64

00:07:00

failed #197025
amd64 linux
system:gcc:jessie:amd64

00:07:00

failed #197029
amd64 linux
system:gcc:sid:amd64

00:06:48

failed #197045
linux amd64
system:gcc:sid:amd64

00:07:08

failed #197031
i386 linux
system:gcc:sid:i386

00:06:45

failed #197044
linux i386
system:gcc:sid:i386

00:07:00

failed #197049
linux amd64
system:gcc:stretch:amd64

00:07:01

failed #197027
amd64 linux
system:gcc:stretch:amd64

00:07:08

failed #197035
amd64 linux
system:gcc:xenial:amd64

00:08:05

failed #197052
linux amd64
system:gcc:xenial:amd64

00:06:40

failed #197042
amd64 linux
system:pkcs11:sid:amd64

00:07:04

failed #197048
linux amd64
system:pkcs11:sid:amd64

00:07:04

 
Name Stage Failure
failed
system:asan:sid:amd64 Test
No job log
failed
system:gcc:centos6:amd64 Test
No job log
failed
system:gcc:sid:i386 Test
No job log
failed
system:gcc:xenial:amd64 Test
No job log
failed
system:gcc:bionic:amd64 Test
No job log
failed
system:pkcs11:sid:amd64 Test
No job log
failed
system:gcc:stretch:amd64 Test
No job log
failed
system:gcc:sid:amd64 Test
No job log
failed
system:gcc:fedora29:amd64 Test
No job log
failed
system:gcc:jessie:amd64 Test
No job log
failed
system:gcc:centos7:amd64 Test
No job log