DNSSEC only works when DNSKEYs are self signed. This only occurs when the DNSKEY RRset is at the apex. Cause dnssec-signzone to fail if it attempts to sign an non-apex DNSKEY RRset.