A new bind has been pushed to bionic (1:9.11.3+dfsg-1ubuntu1.2). This is newer than bind9 in ppa:freeipa/ppa, but does not contain the fix for this bug. Therefore, bind9 upgrade should be prevented by helding the ppa package, or bind9-pkcs11 will stop working.
A new bind has been pushed to bionic (1:9.11. 3+dfsg- 1ubuntu1. 2). This is newer than bind9 in ppa:freeipa/ppa, but does not contain the fix for this bug. Therefore, bind9 upgrade should be prevented by helding the ppa package, or bind9-pkcs11 will stop working.