Complains about key size and algorithm

This happens if we audit the zone for the first time, and the key comes from the unsigned zone. It is thus not created by OpenDNSSEC and can thereby not follow the policy.

3: New ZSK DNSKEY has incorrect algorithm (was RSASHA1) or alg_length (was 1024)