DNSSEC only works when DNSKEYs are self signed. This only occurs when the DNSKEY RRset is at the apex. Cause dnssec-signzone to fail if it attempts to sign an non-apex DNSKEY RRset. (cherry picked from commit b3efc15be4)
b3efc15be4