DNSSEC: maintain mode with KSK offline?

[Diego Martínez]

Hi,

if I use bind with zone options:
	auto-dnssec: maintain
	inline-signing: yes

the KSK (public and private parts) must be on-line, right?
Even if not required to sign the DNSKEY records?




Thanks,
best regards.