/usr/sbin/tsig-keygen is in bind9 1:9.10.3.dfsg.P4-12.3+deb9u4.
This file is owned by root:root, with mode 0o777.
It is a symlink to /usr/sbin/ddns-confgen
/usr/sbin/ddns-confgen