dns_dnssec_keyfromrdata() only needs to be called once per DNSKEY rather than once per verification attempt.