DNSSEC resign zone

For dynamic zones, issue a

rndc freeze
before editing the unsigned zone file, and continue accepting dynamic updates afterwards:

rndc thaw