Under "Second step for KSKs" it says: 1. Extract the DNSKEY record for both ... and publish them in the parent zone Shouldn't that be DS instead? DW