Desire ManualKeyGeneration per key-type and/or policy

Presently the ManualKeyGeneration of the Enforcer is only set there. This does not make it possible to only want to do the KSK manually. Nor does it really allow a mixed environment with more and less secured domain names using the same secure server, but with the option that the "less critical" zones can maintain themselves.