When using dnssec-policy with dnssec-keygen in combination with setting the key-directory on the command line, the commandline argument takes priority over the key-directory from the default named.conf.