Secure Dynamic Update with TSIG on Windows clients?

[Steven Brown]

It seems Secure Dynamic Update on Windows clients violates the standard 
in such a way that the only server that can be used is Microsoft's (gee, 
what a surprise).  However, I want to do it anyway.  What's the best way 
to do this, ideally with only Open Source software?  I could script up 
something to run a win32 build of nsupdate periodically but that seems 
rather hacky and a pain to maintain.