The dnssec-ksr tool needs to read a dnssec-policy from configuration too, as well as deal with FIPS mode checks.