doc: improve some dnssec-related descriptions

doc/configuration.rst

@@ -572,8 +572,11 @@ master's SOA serial in a special variable inside KASP DB and appropriately
 modifiying AXFR/IXFR queries/answers to keep the communication with
 master consistent while applying the changes with a different serial.
 
-It is recommended to use UNIX time serial policy on master and incremental
-serial policy on slave so that their SOA serials are equal most of the time.
+.. NOTE::
+   It is recommended to use UNIX time serial policy on master and incremental
+   serial policy on slave so that their SOA serials are equal most of the time.
+
+   The opposite configuration is not supported yet.
 
 .. _query-modules:
 

doc/man/knot.conf.5in

@@ -759,6 +759,14 @@ Has infuence over ZSK key lifetime.
 .UNINDENT
 .UNINDENT
 .sp
+\fBWARNING:\fP
+.INDENT 0.0
+.INDENT 3.5
+Ensure all DNSKEYs with updated TTL are propagated before any subsequent
+DNSKEY rollover starts.
+.UNINDENT
+.UNINDENT
+.sp
 \fIDefault:\fP zone SOA TTL
 .SS zone\-max\-ttl
 .sp

doc/reference.rst

@@ -839,6 +839,10 @@ A TTL value for DNSKEY records added into zone apex.
 .. NOTE::
    Has infuence over ZSK key lifetime.
 
+.. WARNING::
+   Ensure all DNSKEYs with updated TTL are propagated before any subsequent
+   DNSKEY rollover starts.
+
 *Default:* zone SOA TTL
 
 .. _policy_zone-max-ttl: