support dnssec_signed = "no".
automatically disable dnssec_signed if parent zone is not signed.