The "resolvconf" parameter in /etc/dnssec-trigger/dnssec-trigger.conf is also ignored. I set this to a bogus file, and found the bogus file was not created, and the existing resolv.conf was replaced. It seems much of the configuration files don't match up with implemented functionality.