correct syntax for TSIG & IP restrictions for named-ACL versus just IP?

[pgngw+dev001+bind-users at f-m.fm]

hi,

On Sun, 05 Dec 2010 19:16 +0100, "Sten Carlsen" <stenc at s-carlsen.dk>
wrote:
> Given that you control your key distribution correctly and safely, would
> the following work?
> 
> allow-transfer { key key-slave-1; key key-slave-2; };
> 
> 
> Only relevant slaves have the various keys, so do you need to have the
> IPs mentioned here?

the goal is to have both IP- & key- restrictions in place.

fwiw, the orig example i found for this was @:
https://lists.isc.org/pipermail/bind-users/2009-April/075985.html

thanks!