When signing a zone with dnssec-policy, we don't mind DNSSEC records. This is useful for testing purposes, and perhaps it is better to signal this behavior with a different configuration option.