Extract the part of dns_zoneverify_dnssec() responsible for checking the DNSKEY RRset at zone apex to a separate function.