key
An ordered list of references to TSIG keys. The query must match one of them. Empty value
means that TSIG key is not required.
Default: not set
This is not 100% correct. At least with a notify ACL the behavior is:
Empty value means that TSIG keys are not allowed.
regards
Klaus