It does not make sense to sign RRsets other than DNSKEY with revoked keys. (cherry picked from commit 23775c6006)
23775c6006