3 ms·

I think DNSSEC already deals with this by offline signing another key that actually signs the DNS root zone.