On Thu, Nov 20, 2008 at 11:55:17AM +0000, Chris Thompson <cet1 at cam.ac.uk> wrote a message of 33 lines which said: >> The text you quote is for DNS publication. But you typically do not >> put KSK in the DNS, no? > > Sure you do. How could a validator use it if you didn't? Because it is published as a trust anchor?