nThe child has to:
ube secure (see ÒSigning the local
zoneÓ)
uupload (off-band) the KSK to the parent
nThe parent has to:
ugenerate the DS record from the
KSK of the child
usign the DS record with his own
ZSK (re-sign his zone)
nThen the parent has to repeat the
process, going to his own
parent, and so on, till the "." (root)
n
nAll
of this is done automatically - using tools