TSIG for AXFR with BIND backend

[MattCrum1]

Hi all - I'm using PDNS auth-49 running in Docker, with the BIND backend.

Trying to get an authoritative RPZ secondary set up, pulling zones from ioc2rpz using a TSIG key.

Working configuration in BIND looks like this:

key "ioc2rpz-net-1234redacted"{
  algorithm hmac-sha256; secret "redacted";
};

zone "blocklist-malicious.ioc2rpz" {
  type slave;
  file "blocklist-malicious.ioc2rpz";
  masters { 94.130.30.123 key "ioc2rpz-net-1234redacted"; };
};

PDNS-Auth fails to load, complaining about the "masters" line; but loads OK when I remove 'key "ioc2rpz-net-1234redacted"'. The zone does not transfer (obviously) because the TSIG key is not being sent with the AXFR request.

I read about using pdnsutil to define the keys and associate them with a zone, but looks like this is not compatible with the BIND backend?

https://doc.powerdns.com/authoritative/tsig.html

Can we confirm how to define and enable TSIG keys for AXFR requests with the BIND backend?