If you update a DNS Record in a virtual server, any aliases of that virtual server are then updated. This makes perfect sense. The problem is that when the aliases are updated they are accidentally having their DNSSEC information removed. For example, I created a virtual server for something.com and then created everything.com as an alias of something.com. Virtualmin is configured to setup DNSSEC automatically as NSEC3RSASHA1. I log into Virtualmin for something.com, click "DNS Records" and add an A record of "testing". If I then look at the raw zone files for something.com it still has the DNSSEC records present, however the raw zone file for everything.com doesn't have any DNSSEC records present (and it did before creating the "testing" A record).
Alias virtual server DNSSEC removed when parent updated