If you add a zone while enforcer is not running you can't delete it afterwards since ods-ksmutil zone delete will try and move away the signerconf and failing that it will just exit(-1);
Maybe it should check if it exists first and not fail if it doesn't.
read(5, "<?xml version=\"1.0\" encoding=\"UT"..., 4096) = 750
read(5, "", 4096) = 0
close(5) = 0
munmap(0x7fe220af1000, 4096) = 0
rename("/var/lib/opendnssec/signconf/example2.com.xml", "/var/lib/opendnssec/signconf/example2.com.xml.ZONE_DELETED") = -1 ENOENT (No such file or directory)
fcntl(3, F_SETLK,
) = 0
close(3) = 0
exit_group(-1) = ?