There are times where you want named-checkconf to check whether the dnssec-policies should be constrained by the cryptographic algorithms supported by the operation system or to just accept all possible algorithms. This provides a mechanism to make that selection.