dns_dnssec_updatekeys's 'report' could be called with invalid arguments which the compiler should be be able to detect.