https://gitlab.labs.nic.cz/knot/knot-dns/issues/176 possible to reuse?: https://pagure.io/freeipa/blob/master/f/ipaserver/dnssec/odsmgr.py#_80