Signature problem on SOA RRset

Mathieu Arnold reported:

Yesterday, my monitoring reported a lot of faulty zones, validns complained
of :

1. validns -p all -z 1-wire.fr master/1-wire.fr.signed
   master/1-wire.fr.signed:15: 1-wire.fr. RRSIG(SOA): cannot verify the
   signature

And some more info:

Only the SOA is.

<SOA>
<TTL>PT12H</TTL>
<Minimum>PT10M</Minimum>
<Serial>counter</Serial>
</SOA>

SoftHSM.

There might have been a ZSK rollover before that.

I suspect a corner case condition where either:

• the signature for the updated soa record was not renewed, or
• the signature was renewed before updating the soa record