SOA got invalid signature

As reported by Mathieu Arnold and responded to my Matthijs:

Thanks for this information. I suspect a corner case condition where either:

• the signature for the updated soa record was not renewed, or
• the signature was renewed before updating the soa record

I'll look into this.