DNSSEC: separate low level signing interface from SIG(0) code

refs #2413

Change-Id: I5d029c5a9eb655a42f6eaaf23be062e0a8ef96d3