add 'at apex' check for inserted DNSKEY records