On Sat, Nov 10, 2018 at 07:00:35PM +0100, Stephane Bortzmeyer <bortzmeyer at nic.fr> wrote a message of 55 lines which said: > But no DNSKEY at all is added in the signed zone. (There are RRSIGs, > and NSEC3.) When the KSK moved to the state Ready, the keys were published. It seems abnormal.