> -----Original Message-----

> The story that I keep on hearing is that even the most experienced engineers

> have issues with understanding the configuration of the KSK and Zone signing

> keys and the key rollover, inconsistencies in documentation and therefore

> lack of adoption, because in case of a mistake this might seriously impact the

> production environment.



I can confirm (from the RIPE meeting where they have a DNS WG) that these concerns are widespread. DNSSEC is brittle and key rollover is a very complicated. 



One thing I heard (do not know this deeply) is that a lot about DNSSEC key management depends on the registrar and every registrar does it differently.