If you e.g. try to have TSIG on your hidden master and disable TSIG in OpenDNSSEC. Then you will not be able to do a zone transfer. OpenDNSSEC then get RCODE=5 from the hidden master. This value is printed as an interger to syslog. Would it be possible to print the name of the RCODE? In this case it would be REFUSED. This will perhaps give a better hint to the user that it probably have forgotten to configure or using the wrong TSIG.
I think it is only printed here:
signer/src/wire/xfrd.c:751