Please review rt46430.  It is based on v9_11 and contains a step-by-step
account of the backporting process.

All changes in rt46430 should be applied to v9_11, while v9_10 and v9_9
will only need the fix for RT #46055 (one-line change to lib/dns/zone.c)
as the mkeys system test did not exist until 9.11.

I put the updated mkeys test from the v9_11 branch on a spin for two
hours on Fedora 25, FreeBSD 11.0 and OpenBSD 6.1 VMs and no issues were
exposed, so I expect the branch to be at least relatively stable.