Prior to this change, non-apex DNSKEYs were not signed and invalid NSEC
records were generated for these nodes.