The operation gets ridiculously slow (tens of ops/sec), it is now called
only after a zone flush (certain change, ixfr, update or signing) or
after non-bootstrapping transfer.

partial port of 88e68d90678eeddcdafd56894af1681476032209