Evening all, RFC5155 says, on page 32, "zone signing tools SHOULD NOT default to using opt-out". But in trunk/OpenDNSSEC/conf/kasp.xml.in we turn opt-out on... Should we comment this tag out? Cheers, Sion