Check the policy and feed 'dns_dnssec_syncupdate() the right value to enable/disable CDSNKEY publication.