Add option to manually trigger key rollover with automatic key management
It would be nice if there was a command to trigger immediate key rollover. For instance, when there is some manual work required to update parent DS record, operator may initiate the KSK rollover manually at their convenience, instead of on regular intervals. Setting a KSK lifetime in the policy can lead to unnoticed rollovers, which would then get stuck in the middle for quite a long time and block the forthcoming ZSK rollovers.
I know it is possible to roll a key manually by generating a new key and retiring the old one using keymgr
utility, but such approach is too dangerous for a casual operator and can lead to a bogus zone very easily. I would like to have a simple command like knotc zone-keyroll <zone-id> <key-id>
.