nOnly an administrative
distinction, you cannot tell from the
KEY record itself!
nDS points to a key signing key
(KSK)
nThe zone is signed with a zone
signing key (ZSK)
u(these keys may be the same)
nKey signing key may be long lived,
and ÒbiggerÓ
nZone signing key may be short
lived
ucan be ÒsmallerÓ = ÒfasterÓ