per DNS server (vs current per DNS domain) TSIG key in D2

This ticket should do three things:

change the D2 core code so the TSIG key is per DNS server instead of per DNS domain (a DNS domain includes a list of DNS server)
add a callout point in the new method which looks for the TSIG key from the DNS server
extend the D2 syntax to offer this new feature to users

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information