consistency: everywhere else a dash (-) is used (zone-signing keys, key-signing keys)
double can
old information does not expire from the cache in this case: both the old and new DNSKEY and signatures are in the zone and thus in the cache.
of the three methods
It seems to me this should be just the other way around
suggested changes to rollover state definitions
re-signed with the current *active* key-signing key*s*
is also true for the average and best case
Put the math for Tact(key) at Event 4 in the ZSK Pre-Publish method.
Should this be greater than or equal to? Since Lzsk is a policy thing and not a strict enforcement
Having an expired DNSKEY in the cache is just weird.
slaves can be masters and so, just better to avoid the terminology and say "name servers"
Add the (key) parameter
If you publish the key and immediately use it for signing then Tpub == Tact
The successor [-is] key is
missing closing parentheses