Is it possible to enable RFC2136 DNS updates for a samba-AD domain?

I'm experimenting with a Synology NAS that's running bind9 and samba to host a local subdomain with an AD realm of the same name, e.g. domain : sub.x.notcom, realm : sub.x.notcom ... I'll substitute my actual domain for this in the question.

I wanted the ability to do RFC2136 updates of the zone, so I created a HMAC-SHA512 key stored in named/etc/key and told bind about it:

./named/etc/conf/named.key.conf:include "/etc/key/update-key";

verified this is the correct path inside the chroot (named won't start if it is not)

I saw that the update-policy is stored in named/etc/samba/private/named.conf.update, which is auto-generated, but I discovered that the generator looks for a file called "named.conf.update.static" to allow you to introduce additional grants, so I added one:

named/etc/samba/private/named.conf.update.static

grant update-key wildcard * CNAME;

and verified that this was rolled into the named.conf.update file after a few minutes:

sh-4.3# more named/etc/samba/private/named.conf.update*
::::::::::::::
named/etc/samba/private/named.conf.update
::::::::::::::
/* this file is auto-generated - do not edit */
update-policy {
/* Start of static entries */
grant local-ddns wildcard * CNAME;
/* End of static entries */
        grant SUB.X.NOTCOM ms-self * A AAAA;
        grant Administrator@SUB.X.NOTCOM wildcard * A AAAA SRV CNAME;
        grant synology$@sub.x.notcom wildcard * A AAAA SRV CNAME;
};
::::::::::::::
named/etc/samba/private/named.conf.update.static
::::::::::::::
grant local-ddns wildcard * CNAME;

I then tried to generate a DNS update using nsupdate

# nsupdate -k named/etc/key/update-key
> update add foo.sub.x.notcom. 300 IN CNAME www.google.com.
> send
; TSIG error with server: tsig indicates error
update failed: NOTAUTH(BADKEY)

> answer
Answer:
;; ->>HEADER<<- opcode: UPDATE, status: NOTAUTH, id:  45171
;; flags: qr ra; ZONE: 1, PREREQ: 0, UPDATE: 0, ADDITIONAL: 1
;; ZONE SECTION:
;home.kfs.org.                  IN      SOA

;; TSIG PSEUDOSECTION:
update-key.             0       ANY     TSIG    hmac-sha512. 1623287759 300 0  45171 BADKEY 0

A LOT of this seems undocumented (e.g. the .static file), and a lot of the parameters in config files also seem to be undocumented/virtually absent from google/ddg.

It seems like I've only told Bind about the update key but not samba. Aside from nsupdate, my original test-case client was going to be certbot's "dns-rfc2136" client.

Is there a way to allow rfc2136 updates to a samba-controlled dns domain?