If this helps, on my quest to build a 9.3.1 version of dnssec-makekeyset, it appears the vanilla ISC distribution does not build this executable by default. I have been hacking on the source tarball's bin/dnssec/Makefile to add this to the list of targets to be built (and duplicating information from dnssec-keygen) to get this created. So I am thinking this is not a Debian-specific bug.
Thanks,
Scott
