Use local mode of nsupdate, then we don't even need a keyfile