Going through the logs and found the problem: ods-enforcerd: [enforcer] updateZone Ready for transition but key material not backed up yet after a 'ods-ksmutil backup prepare' and a 'ods-enforcer backup commit' (and a ods restart) it worked, and I got an e-mail with the new KSK key. --Dennis