I'm moving my DNS servers into containers and simplifying their
numbering. I'll update the glue records one at a time to make
sure that at least one server is accessible.
I failed to remember that the domain name is included in the key digest.
This time I verified it works through Unbound (and switched DNS servers
while I was at it, hence the extra record).