[Opendnssec-develop] review: Signature recycle etc.

[Sion Lloyd]

> 
> > please review http://trac.opendnssec.org/wiki/Signer/Signatures.
> 
> How will this affect the Enforcer? Does it e.g. take recycling into
> account when rolling ZSK?

For ZSKs we move from retire to dead after:
zsksiglife + propdelay + retire safety

and for KSKs it looks like:
kskttl + kskpropdelay + retire safety


If we keep keys in the retire state for an additional "expiration minus 
Refresh" then we are covered. (Maybe just expiration to be on the safe side?)

Does this change need to be made to trunk?