...in order to avoid wrong SEP bit after KSK versus ZSK change
Also, allow SEP bit setting of already generated key.