> But when you get the records, you don't get the signatures; you just get a single bit in the header that says "I pinky swear that I checked the signatures".

> But when you get the records, you don't get the signatures; you just get a single bit in the header that says "I pinky swear that I checked the signatures". Clients absolutely do get RRSIGs (and relevant NSEC/NSEC3) however they don't necessarily validate them.