dnssec: don't involve public-only keys in algorithm usage checks

diff --git a/src/knot/dnssec/zone-keys.c b/src/knot/dnssec/zone-keys.c
index 76a1f63f12f1cdfded4d086bb5205d593006370f..16689feb54e1439f59780b7fd7c4f3ae0cb8f4af 100644 (file)
--- a/src/knot/dnssec/zone-keys.c
+++ b/src/knot/dnssec/zone-keys.c
@@ -386,6 +386,9 @@ static int walk_algorithms(kdnssec_ctx_t *ctx, zone_keyset_t *keyset)
 
        for (size_t i = 0; i < keyset->count; i++) {
                zone_key_t *key = &keyset->keys[i];
+               if (key->is_pub_only) {
+                       continue;
+               }
                uint8_t alg = dnssec_key_get_algorithm(key->key);
 
                if (ctx->policy->nsec3_enabled && !is_nsec3_allowed(alg)) {