Signing a DNS UPDATE with multiple active SIG(0) keys doesn't work; must only use one

[johanix]

I think the problem is that the SIG signs the entire message, except for itself. That will fail when a second signature adds more data to the message after the first SIG was created. So this is a reasonable limitation, but it means that we must ensure only to sign with one key at a time.

• Ensure that we only sign with one active SIG(0) key
• Ensure that only one SIG(0) key can be active at any one time