external-dns required axfr support to remove old records. add the capability for the externaldns tsig key. Reviewed-on: #456