/usr/sbin/tsig-keygen is in bind9 1:9.11.3+dfsg-1ubuntu1.
This file is owned by root:root, with mode 0o777.
It is a symlink to /usr/sbin/ddns-confgen
/usr/sbin/ddns-confgen