Miscalculate number of required keys when using shared ones

From user mailing list:
We are getting the following errors in our logs (zonename replaced with <zone>):

ods-enforcerd: [ID 992331 local0.warning] Not enough keys to satisfy zsk policy for zone: <zone>. keys_to_allocate(1) = keys_needed(2) - (keys_available(2) -
keys_pending_retirement(1))

ods-enforcerd: [ID 115111 local0.warning] Tried to allocate 1 keys, failed on allocating key number 1

ods-enforcerd: [ID 482275 local0.warning] ods-enforcerd will create some more keys on its next run

ods-enforcerd: [ID 363081 local0.error] Error allocating zsks to zone <zone>