zone-api: Partial port of DNSSEC + zone update iterations.