when using the trust anchor dsset as val->dsset, keep a reference to the keynode so dsset can't be freed.