> I appreciate any hint. Thanks. If you run: ods-ksmutil key list --zone sub.domain.tld you will be told the state of the KSKs in that zone, I'm guessing that they are in the READY state, or maybe PUBLISHED. Then you can add "--keystate <STATE>" to the export command. If that doesn't work then let me know and we can have a closer look. Cheers, Sion