Re-marking as Invalid since I finally figured out today the erroneous RR was not generated by dnssec-signzone but a 3rd party tool that mistakenly writes the salt-length field too (which shouldn't be present except in the on-the-wire RDATA).
Re-marking as Invalid since I finally figured out today the erroneous RR was not generated by dnssec-signzone but a 3rd party tool that mistakenly writes the salt-length field too (which shouldn't be present except in the on-the-wire RDATA).