If bind.keys is missing, named falls back to using built-in keys for
dnssec-validation (and currently lookaside) auto.

However, if bind.keys exists but is empty, then named doesn't fall back;
it just treats it as an empty trust anchor configuration and runs without
validating.

It should detect the absence of the key it wanted and either fall back to
built-in, or log an error and exit.