The dnssec-must-be-secure feature was added in the early days of BIND 9 and DNSSEC and it makes sense only as a debugging feature. There are no reasons to keep this feature in the production code anymore. Remove the feature to simplify the code.