Use TSIG-signed updates using the local-ddns key.