lib/dnssec: make kr_dnskeys_trusted() cleaner

This way it will be easier to re-use (and more efficient).
I really disliked those searches for RRSIGs embedded deep inside.

Uh, I tried to keep the new function as clean as possible,
moving hacks to outside.