I think the my trick (copy /usr/sbin/named into /usr/sbin/named-pkcs11) works quite well. Not sure about the differences between named and named-pkcs11, but I think it is essentially the fact that named-pkcs11 supports cryptographic devices while plain named doesn't. In order to avoid /usr/sbin/named-pkcs11 to be rewritten during an update, you may want to use dpkg-divert.
I think the my trick (copy /usr/sbin/named into /usr/sbin/ named-pkcs11) works quite well. Not sure about the differences between named and named-pkcs11, but I think it is essentially the fact that named-pkcs11 supports cryptographic devices while plain named doesn't. In order to avoid /usr/sbin/ named-pkcs11 to be rewritten during an update, you may want to use dpkg-divert.