nParents needs to check if the child KEY is
really their childŐsÉ Did
you get the KEY from the source
authoritative for the child zone?
nThis needs an out-of-DNS identification
nOpen operational
issue:
nHow do you identify the KEY comes from an authoritative
source?
uBilling information?
uPhone call?
uSecret token exchange via surface mail?