signed zones end up here for inclusion into the nsd config
