Additional comments:
	The tools that come with bind are tailored to a the RFC2535 with addition of the delegation signer concept.
	The version of host that comes with bind8 can verify a zone tree.
	named-checkzone and named-checkconf use the same routines to read the zone and configuration files as named itself. If the checks succeed the nameserver will successfully digest the files too. The programs only do parsing checks, you still have to make sure your zone is properly configured.
	The dnssec-makekeyset and dnssec-signkeyset are not in bind9.3s20020722. They may return in a different incarnation but if you have the commands on disk they are from an earlier release.