0. Root (".") KSK is manually configured into all resolvers as "trusted key";
	1. Root zone itself contains KSK and ZSK (2983)
	2. ...  and the signature over the ZSK _with_ (by) the trusted KSK.
	3. DS record of the child ("net") is signed with the ZSK (note: italic style).
	---
	4. DS record in the "root" zone points to the KSK of the "net" zone.
	5. With the KSK, the ZSK of the "net" zone is signed, which produces the SIG record over the KSK (by the ZSK).
	6. ZSK is also used to sign the DS record of "ripe(.net)".
	---
	All over again:
	7. DS record in he parent ("net") points to the KSK of "ripe.net".
	"ripe.net" has two keys: KSK and ZSK;
	8. KSK is used to sign the ZSK
	(hence, SIGnature by KSK over ZSK)
	9. ZSK (italic) is used to sign the zone data, including the A record for "www" (hence, SIGnature by ZSK over A)