dnssec-signzone was designed so that it could sign a zone partially, using only a subset of the DNSSEC keys needed to produce a fully-signed zone. This permits a zone administrator, for example, to sign a zone with one key on one machine, move the resulting partially-signed zone to a second machine, and sign it again with a second key. An unfortunate side-effect of this flexibility is that dnssec-signzone does not check to make sure it's signing a zone with any valid keys at all. An attempt to sign a zone without any keys will appear to succeed, producing a "signed" zone with no signatures. There is no warning issued when a zone is not signed. This will be corrected in a future release. In the meantime, ISC recommends examining the output of dnssec-signzone to confirm that the zone is properly signed by all keys before using it.