Add a function that checks whether a DNSKEY, CDNSKEY, or CDS record belongs to a key that is being used for signing.