When changing a dnssec-policy, existing keys with properties that no
longer match were not being retired.
(cherry picked from commit 3905a03205)
When changing a dnssec-policy, existing keys with properties that no
longer match were not being retired.
(cherry picked from commit 3905a03205)