the cron job to re-sign DNSSEC zones was still not working because the script needed a hash-bang line; what I did in 65c3a44e63b24c1d428bd0a53c9f6b6b34a6a858 didn't actually fix the problem