DNSKEY can only be validated if it is signed by itself. Stop attempting to sign non apex DNSKEY RRsets.