Bind 9.18.18 dnssec key location and privileges?
[update, solved] It was apparmor, which was lying about being inactive. Ubuntu’s default profile denies bind write access to its config directory. Needed to add /etc/bind/dnskeys/** rw, reload apparmor, and it’s all good....