...automatic KSK roll must ensure that new KSK has been signing the DNSKEY for dnskey-ttl seconds before submission updates DS
...automatic KSK roll must ensure that new KSK has been signing the DNSKEY for dnskey-ttl seconds before submission updates DS