I tested with 1000 zones and 1 policy.
select v.id as id,
location,
algorithm,
policy_id,
securitymodule_id,
size,
compromisedflag,
d.zone_id as zone_id
from
(
select k.id as id,
k.HSMkey_id as location,
z.id as zone_id,
k.algorithm as algorithm,
k.policy_id as policy_id,
k.securitymodule_id as securitymodule_id,
k.size as size,
k.compromisedflag as compromisedflag
from keypairs k
left join zones z
where k.policy_id = z.policy_id
) v
left outer join dnsseckeys d on d.zone_id = v.zone_id and d.keypair_id = v.id;
As the subselect joins zones on the policy and I have 1000 zones in the same policy I will get 1000 hits per row in keypairs. This results in 2000(keypairs)*1000(zones)=2000000 hits.
From what I can see the subselect is used to fetch the z.id/zone_id related to the policy in order to check if there are related dnsseckeys matching the keypair_id and if so return the zone_id of that.
This can be done without a subselect using 2 outer joins:
select k.id as id,
k.HSMkey_id as location,
k.algorithm as algorithm,
k.policy_id as policy_id,
k.securitymodule_id as securitymodule_id,
k.size as size,
k.compromisedflag as compromisedflag,
z.id as zone_id
from keypairs k
left outer join dnsseckeys d on d.keypair_id = k.id
left outer join zones z on z.id = d.zone_id and z.policy_id = k.policy_id;
For each keypair we check if there is a dnsseckey.
For each of the matching dnsseckeys we check if the zone exist with the keypair.policy_id and if so return the z.id as zone_id.
Is this correct assumption?