dns_dnssec_verifymessage should make sure that it's verifying with the right key (which should be the case anyway, but it never hurts to check). Also fix a memory leak and change a few _tostruct() calls to not allocate memory.