pdnssec check-zone, fix DNSKEY checks