Ghost User
--- a/src/libknot/dnssec/zone-events.c
+++ b/src/libknot/dnssec/zone-events.c
 	}

 	// update SOA if there were any changes
-	result = knot_zone_sign_update_soa(zone->contents, &zone_keys, &policy,
+	const knot_rrset_t *soa =
+		knot_node_rrset(knot_zone_contents_apex(zone->contents),
--- a/src/libknot/dnssec/zone-nsec.c
+++ b/src/libknot/dnssec/zone-nsec.c
+	if (fixed_nsec == NULL) {
+		return KNOT_ENOMEM;
+	}
+
+	// Add new NSEC RR to changeset
+	return knot_changeset_add_rrset(out_ch, fixed_nsec, KNOT_CHANGESET_ADD);
+}
+
+int fix_nsec3_chain_for(const knot_node_t *node,
+                       const knot_node_t *to, uint32_t ttl,
+                       knot_changeset_t *out_ch,
+                       const knot_zone_contents_t *zone)
+{
+	//TODO implement, might not be so easy without nice way to get next nodes
+}
+
--- a/src/libknot/dnssec/zone-sign.c
+++ b/src/libknot/dnssec/zone-sign.c
 #include "libknot/dnssec/key.h"
 #include "libknot/dnssec/policy.h"
-#include "libknot/dnssec/rrset-sign.h"
 #include "libknot/dnssec/sign.h"
+#include "libknot/dnssec/rrset-sign.h"
 #include "libknot/dnssec/zone-keys.h"
-#include "libknot/rdata.h"
+#include "libknot/rrset.h"
 #include "libknot/updates/changesets.h"
-#include "libknot/util/debug.h"
 #include "libknot/zone/node.h"
 #include "libknot/zone/zone-contents.h"
+#include "libknot/util/debug.h"

-/*- private API - common functions -------------------------------------------*/
+//! \todo Check if defined elsewhere.