I've made parallel changes in dnssec-keyfromlabel now, and fixed the system
tests that relied on default values. Can I get a final review?