Suggestions?

I believe that our packages won't even install any /etc/knot-resolver/root.keys
I don't think you should have writable root.keys.  Yes, it is possible, but I don't think it's a good approach.

And it says (a bit confusingly) "dir", i.e. /etc/knot-resolver/  That's because of a locking mechanism, using file /etc/knot-resolver/root.keys.lock (in your case, apparently).

--Vladimir