'dnssec-keygen -F' will now turn on FIPS mode if supported by the crypto provider and is not already enabled.