The rndc command 'dnssec -status' only considered keys from 'dns_dnssec_findmatchingkeys' which only includes keys with accessible private keys. Change it so that offline keys are also listed in the status.