> When the shared KSK needed to be rolled over, you would have to > process DS records in the parents of your few dozen zones all at the > same time. *If* you want to roll the KSK, a.k.a. "when did you last roll your SSH keys?" :-) -JP