https://doku.lrz.de/dnssec-mit-bind-9-9-11491403.html
set key directory in
options {
### DNSSEC
dnssec-validation auto;
key-directory "/etc/bind/keys/dnssec";
}create keys in that directory:
dnssec-keygen -a ECDSAP256SHA256 -f KSK -n ZONE domain.tld
dnssec-keygen -a ECDSAP256SHA256 -n ZONE domain.tld