HubN’s reverse zone had valid signatures, a matching DS record and an authoritative server which answered correctly when asked directly. Normal recursive lookups still could not reach it.
The private delegation had been placed below the public arpa. tree. A validating resolver followed the public chain, quite correctly found no private child there, and stopped. None of the cryptography was the problem.
The fix was to make the private view traversable all the way down: root, arpa., ip6.arpa., then the HubN reverse zone. Once the delegation chain existed in the same view, the already-correct signatures became useful.
I had spent too long inspecting keys because the failure looked like DNSSEC. It was ordinary DNS topology wearing a DNSSEC-shaped hat.