this bug bahaves like this: if you configure:
    dnssec-signing: on
    zonefile-load: difference
it will, upon changing zonefile, make inconsistencies in journal
leading in broken IXFR

the reason is that by calling set_new_soa over existing SOA in
changeset (probably because of zone_update_from_differences)
it updates the changeset's soa_from to incorrect value