While `rndc-confgen` creates TSIG keys, there has now for years been a dedicated usitlity for doing so: `tsig-keygen`