Re-ran steps and updated incorrect screenshot with no warning
Added links to recipes for ZSK and KSK rollover
Fixed example RRSIG for ZSK post-rollover
Fixed RRSIG example in KSK pre-rollover
Added paragraph about checking parent authoritative name servers for DS records
Updated KSK day-of-rollover signature => signature(s)
Fixed RRSIG example in KSK day-of-rollover
Added additional note about removing old key.
Fixed RRSIG example in post KSK rollover
Added warning about removing incorrect DS record(s) from parent
Added link to Security Lameness section
Removed "real" domain names in troubleshooting in favor of generic "example.com" across the board
Simple re-wording for clarity
Clarify NSEC and NSEC3 are both for proof-of-non-existence, and added description for salt
syslog => log to be more generic
Same clarification in NSEC3 -> NSEC about proof of non-existence
Clarified which is the salt value
Added clarification which bit is for the opt-out
Moved "Reverting to Unsigned" to its own section, separate from NSEC and NSEC3
Added reference to dnssec-loadkeys-interval
Clarify NSEC3 opt-out behavior