| Subject: | named doesn't fall back to built-in keys if bind.keys is empty |
If bind.keys is missing, named falls back to using built-in keys for
dnssec-validation (and currently lookaside) auto.
However, if bind.keys exists but is empty, then named doesn't fall back;
it just treats it as an empty trust anchor configuration and runs without
validating.
It should detect the absence of the key it wanted and either fall back to
built-in, or log an error and exit.