If the keys are compromised, you need to sign the domain zone with new keys. To do so, disable DNSSEC protection:
.1Delete all the DS-records from the parent domain zone and wait for several hours;
.2Delete the domain signature in →→select a domain→select the checkbox.
Once completed, the system will un-sign all the domain names and delete their keys.