drop default inactive zsk from secure-zone results, closes #824