It would help if you'd flesh out the DNSSEC request with more details.

As for CA/KRA see https://pagure.io/freeipa/issue/3951 as a separate RFE.

Bind9 (powerdns also) support DNSSEC ECC
OpenDNSsec from 2.1.7 also (ed25519)
They are much smaller than RSA which for DNS is important
Cloudflare uses P256 for dnssec also

When i edit kasp.xml in /etc/opendnssec/kasp.xml and set policy (as instructed by https://www.freeipa.org/page/Howto/DNSSEC) with algorithm 13 or 15 it is completly ignored and rsa key is generated (type 8)

sudo -u ods SOFTHSM2_CONF=/etc/ipa/dnssec/softhsm2.conf ods-enforcer key list --verbose
also says that 8 is generated not policy specified 15 or 13

i even tried to edit /var/opendnssec/kasp.db directly changing IPA policy in it (because it looks like kasp.xml is ignored) which somewhat worked but IPA does not publish these in bind9
But
sudo -u ods SOFTHSM2_CONF=/etc/ipa/dnssec/softhsm2.conf ods-enforcer key list --verbose
Shows editing kasp.db directly works

Import of keys also would be good because for now we use separate (PowerDNS) instance for signing FreeIPA records (as slave to ipa dns) then send that to our secondaries with IXFR

With IPA directly we would get rid of one addtional step and just transfer from IPA to public secondaries

As OpenDNSSEC support is Tech Preview only in RHEL, the team cannot not prioritize this request over other developments, but any upstream contribution is more than welcome.