accidentally reversed the default behaviour of pdnssec import-zone-key to making passive keys