This seems reasonable to me as well. There is no reason to prevent the server from reading rndc.key as it is strictly required by the server when its setup to use rndc. Since we (finally) determined that /etc/bind/rndc.key is the documented place for the file, it makes sense to me to add it to the profile. In reading the various manpages, we should also be including /etc/bind/rndc.conf as well (man rndc.conf).
This seems reasonable to me as well. There is no reason to prevent the server from reading rndc.key as it is strictly required by the server when its setup to use rndc. Since we (finally) determined that /etc/bind/rndc.key is the documented place for the file, it makes sense to me to add it to the profile. In reading the various manpages, we should also be including /etc/bind/rndc.conf as well (man rndc.conf).