Usage:
	dnssec-keygen -a alg -b bits -n type [options] name
	Required options:
	-a algorithm: RSA | RSAMD5 | DH | DSA | RSASHA1 | HMAC-MD5
	-b key size, in bits:
	RSAMD5:     [512..4096]
	RSASHA1:     [512..4096]
	DH:     [128..4096]
	DSA:     [512..1024] and divisible by 64
	HMAC-MD5:   [1..512]
	-n nametype: ZONE | HOST | ENTITY | USER
	name: owner of the key
	Other options:
	-c <class> (default: IN)
	-e use large exponent (RSAMD5/RSASHA1 only)
	-g <generator> use specified generator (DH only)
	-t <type>: AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF (default: AUTHCONF)
	-p <protocol>: default: 3 [dnssec]
	-s <strength> strength value this key signs DNS records with (default: 0)
	-r <randomdev>: a file containing random data
	-v <verbose level>
	Output:
	K<name>+<alg>+<id>.key, K<name>+<alg>+<id>.private
	DSA an RSA should have the same signing speed but DSA is slower for verification (There is difference in signing speed though, the speed depends on the implementation.)
	DSA may leak key material when the random number generator used at signing time is not truly random (RFC 2536 sect 5).
	Best use  RSA/SHA-1 (RFC 3110) as soon as it is implemented.
	(For DSA/RSA controversy  also see SchneierÕs  Applied Cryptograpy 2nd ed pp484 486)