In selfsigned_dnskey only call dns_dnssec_verify if the signature's key id matches a revoked key, the trust is pending and the key matches a trust anchor. Previously named was calling dns_dnssec_verify unconditionally resulted in busy work.