Secondary zones need customized storage directory
Creating secondary zones on Debian 10. Both apparmor and bind documentation state the secondary zone files should not be stored in /etc/bind, but in /var/cache/bind. If the storage directory written to named.conf.local could be customized, the setup would work out of the box on Debian 10 with apparmor.
Now tricks need to be applied: