dnssec: avoid checking existing correct RRSIGs twice

...once in remove_expired_rrsigs(), once in add_missing_rrsigs()
this is important because unlike RSASHA, with ECDSA is checking signature far slower than creating one
little side effect: signatures of DNSKEY record by ZSK are always removed