Branch rt46251 fixes this issue by forcing the fetched DNSKEY RRset to
replace the cached one despite having a lower trust level assigned.
Please review.  mkeys system test will be fixed in RT #45293.