Algorithm Key Rollover support

[tobez]

Via Daniel Stirnimann:

• there are multiple RRSIGs for every signed record
• one or more DNSKEYs for some of those RRSIGs is missing
• but there is at least one valid RRSIG for which a valid key is found,
  for every signed record

If so, then it might make sense to not consider this an error at all
(or maybe add a policy check that will make such cases into errors,
thus allowing the operator the degree of control you suggest, effectively).