I would like not to change it too, but the alternative to create records on the fly in the DNS servers is an invitation for DOS attack on DNSsec...
why? the synthesized records are "like" glue records, aren't they? so they shouldn't be signed anyway....? Harald