When changing a dnssec-policy, existing keys with properties that no longer match were not being retired.