doc: fix zone.dnssec-policy and policy.keystore defaults

doc/man/knot.conf.5in

@@ -509,7 +509,7 @@ A policy identifier.
 .SS keystore
 .sp
 A \fI\%reference\fP to a keystore holding private key material
-for zones.
+for zones. A special \fIdefault\fP value can be used for the default keystore settings.
 .sp
 \fIDefault:\fP default
 .SS manual
@@ -870,9 +870,10 @@ Cannot be enabled on a slave zone.
 \fIDefault:\fP off
 .SS dnssec\-policy
 .sp
-A \fI\%reference\fP to DNSSEC signing policy.
+A \fI\%reference\fP to DNSSEC signing policy. A special \fIdefault\fP
+value can be used for the default policy settings.
 .sp
-\fIDefault:\fP default
+\fIRequired\fP
 .SS kasp\-db
 .sp
 A KASP database path. Non absolute path is relative to

doc/reference.rst

@@ -571,7 +571,7 @@ keystore
 --------
 
 A :ref:`reference<keystore_id>` to a keystore holding private key material
-for zones.
+for zones. A special *default* value can be used for the default keystore settings.
 
 *Default:* default
 
@@ -1024,9 +1024,10 @@ If enabled, automatic DNSSEC signing for the zone is turned on.
 dnssec-policy
 -------------
 
-A :ref:`reference<policy_id>` to DNSSEC signing policy.
+A :ref:`reference<policy_id>` to DNSSEC signing policy. A special *default*
+value can be used for the default policy settings.
 
-*Default:* default
+*Required*
 
 .. _zone_kasp-db: