Steps To reproduce :

1. Install ipa server with --setup-dns
2. Enable DNSSEC master: ipa-dns-install --dnssec-master --forwarder x.x.x.x -U
3. Add a new DNSSEC-enabled zone : ipa dnszone-add example.test. --dnssec 'true
4. The new zone is added but the records are not signed.

Last Green run : https://idm-artifacts.psi.redhat.com/idm-ci/freeipa/Nightly-Tier2/RHEL9.8/2025-12-15_16-00/tier-2/upstream-backup-and-restore-testbackupandrestorewithdnssec/1/report.html

Failed run : https://idm-artifacts.psi.redhat.com/idm-ci/freeipa/Nightly-Tier2/RHEL9.8/2025-12-29_16-00/tier-2/upstream-backup-and-restore-testbackupandrestorewithdnssec/2/report.html

the zone doesn't get signedm there is traceback in the journal

https://idm-artifacts.psi.redhat.com/idm-ci/freeipa/Nightly-Tier2/RHEL9.8/2026-01-12_16-00/tier-2/upstream-backup-and-restore-testbackupandrestorewithdnssec/1/logs/test_integration-test_backup_and_restore.py-TestBackupAndRestoreWithDNSSEC-test_full_backup_and_restore_with_DNSSEC_zone/master.testrelm.test/journal

Note : Failing only on rhel-9.8 not on rhel-10.2