When we introduced "dnssec-policy insecure" we could have removed the 'strcmp' check for "none", because if it was set to "none", the 'kasp' variable would have been set to NULL.