diff --git a/CHANGES b/CHANGES
index b3ce6cbf1d..896d0b9651 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2650.	[bug]		Assertion failure in dnssec-signzone when trying
+                        to read keyset-* files. [RT #20075]
+
 2649.	[bug]		Set the domain for forward only zones. [RT #19944]
 
 2648.	[port]		win32: isc_time_seconds() was broken. [RT #19900]
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index a4fd2c7b0c..1a0c97cf20 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -29,7 +29,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signzone.c,v 1.226 2009/08/13 04:13:58 marka Exp $ */
+/* $Id: dnssec-signzone.c,v 1.227 2009/08/14 01:07:00 each Exp $ */
 
 /*! \file */
 
@@ -826,6 +826,12 @@ loadds(dns_name_t *name, isc_uint32_t ttl, dns_rdataset_t *dsset) {
 		return (ISC_R_NOTFOUND);
 	}
 
+	result = dns_db_findnode(db, name, ISC_FALSE, &node);
+	if (result != ISC_R_SUCCESS) {
+		dns_db_detach(&db);
+		return (result);
+	}
+
 	dns_rdataset_init(&keyset);
 	result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_dnskey, 0, 0,
 				     &keyset, NULL);