Pre-publishing alternate operator's DNSKEY records (for operator transfers) is not supported

When attempting to move a signed zone from one operator to another, it is necessary for the losing or gaining operator to pre-publish the public DNSKEYs of the other operator (see RFC6781 § 4.3.5.1).

The Knot DNS 2.2.0 documentation, in section 4.8.6 step 3, states that DNSKEYs manually added to the zone that are not in the KASP database will be removed. However, it does not seem to be possible to import a public-only key into the KASP database.

% keymgr zone key import myzone.foo ~/Kmyzone.foo.+008+07683.key
Failed to import private key (unknown error -13).

% cat ~/Kmyzone.foo.+008+07683.key  
; This is a zone-signing key, keyid 7683, for myzone.foo.
; Created: 20160719083211 (Tue Jul 19 08:32:11 2016)
; Publish: 20160719083211 (Tue Jul 19 08:32:11 2016)
; Activate: 20160719083211 (Tue Jul 19 08:32:11 2016)
myzone.foo. IN DNSKEY 256 3 8 AwEAAZvhhznbgkbCPoKkVXNvujk9apLeBFy0og2uTqdxeJ2PZ371TZCF V2bu2Ut/f0iA53LGmbraGvEB69N1vaE+q4O4Bkx/S29ySOopQotlZAxB jlJ4CekpAY8ibP6xwCUR+4/evRQ7OR+SNTHYwc8KLzIEHCY5OL5mXO5s +m+wFEpRrVA0F6CeT/0CodABlK82pjkZZRK8BYu1m3ZtTXCZ7UnL4+TW d82hgmrvjHUQpBGu7VWeISafr/t4IIGCYr/Wk9wRurQTGgNNDfrlWbEM xwY0oW3yyKZPru/Eux/7AqoJH3UzTC2Qe0gcrYXgxxLBA5f9iPEiaqrl /wzP+zBwtPc=