add a dot
Ipub of the DNSKEY thus Ipub(key)
all active KSKs, not only the current and successor (although in practice that will usually be the case).
(DS) -> (ds)
IpubP(ds) is just Ipub(ds)