dnssec: fixed signing by KSK in ready state
This fixes cases when mysteriously some DNSKEY RRSIGs were missing in the zone and re-appeared after resign. The problem started to be frequent after !751 (merged) but is not depending upon.
Edited by Libor Peltan