Assigning an IP address to a zone apex is usually now done for WWW servers, not login
hosts, and having redirectors in place adds more chaos.

If dirmngr could look for an SRV record, _finger._tcp, to get a better host to try,
that might help finger, and thus federated key lookup, regain some traction.