To be globally secure, it is required that your parent says you are secure. This draft depends on the Signing Authority draft. Gone from earlier versions of this draft is the NXT hack. That would have gotten rid of NULL keys. But operators indicate that these do not seem to actually be a problem.
Draft needs a further revision of the English, due to misunderstandings but non English readers.
Draft will go for WG Last Call after these revisions. Want their own RR so DHCP servers can mark names so others will know who set them. They have tried to specify using TXT, SIG, and KEY to store the data they want in the DNS but those are misuses of RRs intended for other purposes. Lively discussion about the need for this and why DHCP people want this. Uses hashes of names.