Remove deprecated bind settings from template config
dnssec-enable
and dnssec-lookaside
are obsolete and have no effect since BIND 9.15.
Also, I think dnssec-validation yes;
should be changed to dnssec-validation auto;
(see dnssec-validation
under https://bind9.readthedocs.io/en/v9_16_8/reference.html#boolean-options), or am I missing something?