The test case for zsk-retired was missing the actual checks. Add them and fix the set_policy call to expect three keys.