Be careful before create or deleting keys using ods-hsmutil, as the changes are not synced with the KASP Enforcer.
The tool ods-getconf allows you to retrieve a configuration value from conf.xml, given an expression. Introduced in 1.3.18.
The Auditor (ods-auditor) can do an audit of the zones in the system to see if the signer complies to what the policy mandates. It is run automatically (unless disabled) after each resigning of a zone and will stop the signed zone from being distributed if it finds any issues. Any errors found by the ods-auditor will be logged to the configured syslog utility. This should be checked for debug if you have issues.